This is fairly straightforward ratware. Is there anything in particular you wish to know about how it operates?
browser.php is an amusing one for reversing obfuscation tricks, if anyone wants practice.
You should treat the server as compromised and rebuild from metal, by the way. I know that is annoying as heck but they clearly got code execution and you can therefore assume they had root if they wanted it and that any attempts to detect whether they did are useless because their rootkit makes the box lie to you about its current state.
browser.php is an amusing one for reversing obfuscation tricks, if anyone wants practice.
You should treat the server as compromised and rebuild from metal, by the way. I know that is annoying as heck but they clearly got code execution and you can therefore assume they had root if they wanted it and that any attempts to detect whether they did are useless because their rootkit makes the box lie to you about its current state.