This scampage is Telegram-based and sends all the results through Telegram.
It was shared by a member of the forum with infected code, allowing it to send results to both Telegram bots, one on your end and one to the person who shared it.
We have cleaned it, and the obfuscated code of functions.php has been decoded by @CyberDemon. They have also shared a video of the cleaning process, which we will link here.
Therefore, in functions.php, please change the Telegram token, as well as in infos.php. Alternatively, you can simply unlink the code from functions.php that sends results to avoid receiving the same result twice.
Here is download link:
It was shared by a member of the forum with infected code, allowing it to send results to both Telegram bots, one on your end and one to the person who shared it.
We have cleaned it, and the obfuscated code of functions.php has been decoded by @CyberDemon. They have also shared a video of the cleaning process, which we will link here.
Therefore, in functions.php, please change the Telegram token, as well as in infos.php. Alternatively, you can simply unlink the code from functions.php that sends results to avoid receiving the same result twice.
Here is download link: