notes about similarity to ring.php obfuscation

Author: bediger4000

themes/107.175.218.241-2018-10-14a/README.md

@@ -63,7 +63,7 @@ Ten files' contents differ between original and compromised .zip files.
 * `inc/custom-header.php` - a simple "eval($_POST['something']);" style backdoor
 * `inc/extras.php` - same [file uploader](sessions.php) as `footer.php`, concealed in PHP dropper
 * `inc/jetpack.php` - the [GetDomains](../../GetDomains) recon malware
-* `inc/template-tags.php` - code that will probably crash
+* `inc/template-tags.php` - probably a [ring.php](/plugins/login_wall/ring_decoded) web shell
 * `single.php` - [heavily mutated WSO](wso.php) web shell
 * `template-parts/content-search.php` - changes user's login to have WordPress admin privileges
 * `template-parts/content-single.php` - changes user's login to have WordPress admin privileges
@@ -86,3 +86,24 @@ I'm quite confused by this.
 There's no underlying theme or obvious motivation for including
 this variety of malware.
 There's no obvious reason for including duplicates.
+
+One other puzzler that isn't quite so simple. `template-tags.php`
+is clearly the same obfuscating method as the [ring.php](/plugins/login_wall/ring_decoded) backdoor.
+It's borrowed the comments and function names of some random WordPress file, 
+and changed them to hold gzipped, Base64-encoded, text representation
+of some code.
+The Base64-encoded, gzipped code representation is disguised as a pre-composed HTML <img> tage
+with in-line image data.
+Upon an HTTP request for `template-tags.php`,
+the Base64-encoded text representation gets extracted from the "in-line image data".
+If the HTTP request invoking `template-tags.php` has the correct
+value of parameter named "l__l_", that code gets eval'ed.
+
+None of the well-known passwords "root", "pass" or "avto",
+or the `ring.php` password of "G0YgIaXqx" decodes this.
+
+Other places this one shows up around the web:
+
+* [pastebin](https://pastebin.com/VK0E99Mg)
+* [malwaredecoder.com](https://malwaredecoder.com/result/2a34dabc2d1eea4bff3d9635ab0240ff)
+* [unphp.net](https://www.unphp.net/decode/ec823cd97bd4f411665fffe66144a227/)