Robert

There is a newer version of the webshell-scan called webshell-analyzer that decoding and attribute analysis, which could lead to better detection https://github.com/tstillz/webshell-analyzer