AnonymousFox

//proc/self/root/opt/imunifyav/hook/hooks_alert_ticket.php

#!/usr/local/bin/php -q
<?php

ini_set('memory_limit','-1');

stream_set_blocking(STDIN, 0);
$stdin = fopen('php://stdin', 'r');
$data = stream_get_contents($stdin);
$json = json_decode(trim($data), true);

switch ($json['event']) {
    case 'malware-detected':
        if ($json['subtype'] == 'critical') {
            $report = json_decode(file_get_contents($json['params']['tmp_filename']), true);
            $by_users = [];

foreach ($report as $entry) {
                if (!isset($by_users[$entry['username']])) {
                    $by_users[$entry['username']] = [];
                }
                $by_users[$entry['username']][] = $entry['file'];
            }

if ($by_users) {
                $json = json_encode(['users' => $by_users, 'hostname' => gethostname()]);
                getContent('https://billing.hostpro.ua/custom/api/imunify_ticket.php', $json, ['json' => true]);
            }
        }
        break;
}

function getContent($url, $post_data = 'json', $params = [])
{
    $timeout = !empty($params['timeout']) ? $params['timeout'] : 120;
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_HEADER, 0);
    curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.0.2) Gecko/20021120 Netscape/7.01");
    curl_setopt($ch, CURLOPT_REFERER, $url);
    curl_setopt($ch, CURLOPT_TIMEOUT, $timeout);
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);

if (!empty($post_data)) {
        curl_setopt($ch, CURLOPT_POST, 1);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
    }
    if (!empty($params['ssl'])) {
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
    }
    if (!empty($params['cookie_file'])) {
        curl_setopt($ch, CURLOPT_COOKIEFILE, $params['cookie_file']);
        curl_setopt($ch, CURLOPT_COOKIEJAR, $params['cookie_file']);
    }
    if (!empty($params['userpwd'])) {
        curl_setopt($ch, CURLOPT_USERPWD, $params['userpwd']);
    }
    if (!empty($params['header'])) {
        curl_setopt($ch, CURLOPT_HTTPHEADER, $params['header']);
    }
    if (!empty($params['json'])) {
        curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json']);
    }

$content = curl_exec($ch);

curl_close($ch);
    return $content;
}