Source of the Gootloader touchdown pages reveal various totally different search phrases and phrases the menace actors needed serps to index. The linked subpages (chosen with inexperienced) don’t truly exist. The injected WordPress code defines a number of hooks, certainly one of them is for non-existing pages. This will serve the faux discussion board dialogue, when the sufferer clicks on the search consequence
That hidden ingredient had hyperlinks (chosen with inexperienced) and the matching focused search phrases (chosen with brown):
This hidden ingredient won’t be seen to human webpage guests. But search engine crawlers see and course of it, which tips the various search engines into treating the web site as if it supplies related content material on the poisoned search time period, thus rating the positioning excessive within the search outcomes.
A screenshot of the supply code from a Gootkit/Goodloader touchdown web page. Image courtesy of Sucuri Research.
The report (and screenshot) revealed three promising strings:
The request: $_GET[”a55d837’
A malicious web domain name: ‘my-game[.]biz’
A SQL question (proven on a distinct screenshot in Sucuri’s weblog): ‘SELECT * FROM backupdb_’
Searching Google for code fragment $_GET[”a55d837’ led us to an online decoder page, where the result (now deleted) of another researcher’s query revealed the encoded version of the PHP code used in the malicious web page:
function qwc1() {
global $wpdb, $table_prefix, $qwc1;
$qwc2 = explode('.', $_SERVER["x52105x4d117x54105x5f101x44104x52"]);
if (sizeof($qwc2) == 4) {
if ($wpdb - > get_var("x53105x4c105x43124x20105x58111x53124x5340x28123x45114x45103x5440x2a40x46122x4f115x20142x61143x6b165x70144x62137".$table_prefix.
"x6c163x74141x7440x57110x45122x4540x77160x2075x2047".$qwc2[0].
'|'.$qwc2[1].
'|'.$qwc2[2].
"x2751x3b") == 1) {
and the decoded model of that very same script:
perform qwc1() {
world $wpdb, $table_prefix, $qwc1;
$qwc2 = explode('.', $_SERVER["REMOTE_ADDR"]);
if (sizeof($qwc2) == 4) {
if ($wpdb - > get_var("SELECT EXISTS (SELECT * FROM backupdb_".$table_prefix.
"lstat WHERE wp = '".$qwc2[0].
'|'.$qwc2[1].
'|'.$qwc2[2].
"');") == 1) {
While it isn’t clear how the code ended up on that web site, the Internet by no means forgets: Search engines discovered and listed this evaluation. This gave us the primary perception at what the injected code of the compromised touchdown pages would appear to be.
(Both the evaluation linked above, and one other web page I subsequently discovered on malwaredecoder.com, have been later eliminated by their respective web site house owners. Search outcomes that reveal ephemeral evaluation pages like these are solely obtainable for a brief time frame. If you intend to quote supply supplies from websites resembling these, maintain an offline copy of the web page, as a result of they will not be there once you return.)
At this level we didn’t know precisely how the websites are compromised, however we knew from the report that malicious PHP code is in some way inserted into the WordPress set up.
The search on VirusTotal for content material:”SELECT * FROM backupdb_” provides a few information from a compromised server that include an error message:
WordPress database error: [Table 'interfree.backupdb_wp_lstat' doesn't exist] SELECT EXISTS (SELECT * FROM backupdb_wp_lstat WHERE wp = '117|50|2');
The criminals are doubtless utilizing the database backupdb_wp_lstat, which should have been faraway from the server throughout a cleanup. We have been attempting to find this content material on VirusTotal (search time period: content material:”backupdb_wp_lstat”), hoping we might come across a database dump. It is at all times a good suggestion to arrange these guidelines and do extra retrohunts, which may reveal different invaluable information or information.
We have been fortunate, and located an archive file containing a SQL dump of the WordPress database from a compromised server on a public malware repository.
The WordPress database dump included this desk that incorporates a set of the primary three octets of IP addresses, a block record of IP ranges that can’t revisit the Gootloader web site on the identical day
The dumped database incorporates a desk known as backupdb_wp_lstat. Later evaluation decided that this desk incorporates the IP deal with blocklist the malicious web site makes use of to stop repeat visits.
The obfuscated PHP code was additionally viewable within the database dump:
A block of base64-encoded information saved as a variable named $pposte in a WordPress database
…as was the injected search engine marketing poisoning content material, with the j$okay..j$okay marker:
Malicious search engine marketing content material phrases embedded in a WordPress database desk, linking the positioning to an Excel spreadsheet converter search question
Researchers who wish to hunt for this identifiable string within the Descriptions property of the malicious touchdown pages can use the regex /j$okay([0-9]{1,10})j$okay/
The “place marker” string seems within the OpenGraph metadata search engine marketing headers of a Gootloader-modified internet web page
This marker serves as placeholder for the spot the place Gootloader’s hyperlink to the web page renderer script is inserted. When the Gootloader web page is served up, it excludes the marker from the web page supply.
However, the code extracted from the SQL database dump was not precisely the identical as what was proven within the Sucuri weblog. We continued trying to find extra examples by pivoting on the C2 server my-game[.]biz, and located a handful of PHP information referring to that server:
Files that include references to the Gootloader “mothership” web site (screenshot courtesy of VirusTotal)
The submission title commented_functions.php seemed promising. Indeed, it turned out to be doubtless the work of a researcher, analyzing the PHP supply code from the compromised WordPress set up. It was kindly documented intimately, saving us some evaluation time (which additionally helped as a result of we didn’t have all of the parts).
Commented textual content, preceded with double slashes, paperwork the Gootkit traits of modified internet pages
We have been ready to make use of the base64 string referenced within the “html” remark above to go looking VirusTotal, which led us to a (comparatively) just lately uploaded SQL dump.
a WordPress database dump in VirusTotal
The dump file contained the beforehand referenced base64 blob…
A SQL dump from a compromised WordPress set up incorporates base64-encoded components of the Gootkit/Gootloader modifications
…which, when decoded, output the identical code that was initially revealed by Sucuri:
The decoded base64 information from the WordPress database reveals the PHP script that handles decoding the malicious content material for a web site customer
With this in hand, we had better confidence within the provenance of this malicious code. We additionally recognized the desk the place Gootloader shops it in a compromised WordPress database. Having positioned the dump of the WordPress database and the PHP code on the net decoder web site, we now have an entire copy of the malicious content material hosted on the compromised touchdown websites.
What’s within the touchdown web page code?
This code incorporates a easy PHP command shell, which the Gootloader attackers can use to keep up entry to compromised pages.
The variable $pposte holds the title of the parameter that will get executed. If the compromised web site receives an HTTPS POST with that string in it, the code on the web page will decode and execute any base64 encoded instructions it receives, turning right into a bare-bones command shell the attackers can use to keep up management over the server:
A easy command shell Gootloader inserts into the PHP operating in a WordPress web site the menace actors have compromised
At different factors contained in the code, the script defines filters for WordPress occasions, which set off the execution of capabilities primarily based on predefined circumstances.
For instance, the next perform executes as soon as the attackers have arrange the compromised WordPress setting: the invoked code (referenced as “qvc5”) initializes the backupdb_wp_lstat database desk.
add_action("wp", "qvc5");
This snippet from the qvc5() perform initializes the backend databases utilized by Gootloader:
On making ready the requested internet web page, the malicious occasion handler hooks construct the request to the “mothership” (a reputation I’ve given to the web site the Gootloader operators use to centrally handle their fleet of compromised blogs). The communication sends the mothership the next parameters of the preliminary request, all in base64 encoded type:
One of Gootloader’s most problematic behaviors is that it solely permits the potential sufferer to go to the positioning as soon as in a 24-hour interval. It does this by including the originating IP deal with of this communication (the deal with of the sufferer PC, variable ‘b’ above) to a block record. The server additionally geofences IP deal with ranges, and solely permits requests to originate from particular nations of curiosity to the Gootloader menace actor. The referrer string (variable ‘d’ above) incorporates the unique search phrases.
(In this instance, the “&d=” referrer string is the base64-encoded worth of “google/?q=cisco_wpa_agreement”)
Later, we are going to see that the server’s response would be the faux discussion board web page renderer code.
The mothership sends the faux discussion board web page
The mothership response incorporates two components: one incorporates the HTML header components, and the opposite incorporates the web page physique content material. The two are delimited within the code by a tag.
The header half incorporates a number of components, separated by pipe (“|”) characters. Using what it will get from the mothership, the touchdown web page code will collect the HTML content material:
The portion of the Gootkit code that collects the HTML content material of the faux web page it is going to later draw excessive of the compromised web site
The script provides the whole /24 IP deal with vary the place the request originated to a 24-hour block record. Neither the originating laptop, nor any others with the identical preliminary three units of numbers in its IP deal with, can get the web page once more for at the very least a day. (This was already seen within the SQL database dump):
The Gootkit code blocks repeat guests by including not solely the customer’s IP deal with vary to a block record, however the whole class C IPv4 deal with vary on both aspect of the customer’s deal with, only for good measure
How Gootloader renders the faux discussion board web page
If the request comes from an IP deal with that isn’t on the block record, the malicious code within the compromised WordPress database takes motion and delivers the bogus message board content material (sometimes titled merely “Questions And Answers”) to the customer’s browser.
The Gootloader faux discussion board web page, that includes a “question” and an “answer” that hyperlinks to the Gootloader JScript first-stage payload
The solely seen malicious content material within the supply code of a compromised touchdown web page is an easy inserted JavaScript tag. For instance:
Here, once more, the distinctive key for the contaminated server is used as a parameter assigned to a numeric worth (1174868 within the above instance):
The distinctive secret’s linked in a Javascript code snippet embedded within the compromised WordPress server web page.
This
If the HTTPS GET request incorporates a question string that features the an infection ID, the handler code sends a request to the mothership and renders the response.
We are capable of get the code returned by the mothership by grabbing the faux touchdown web page HTML supply, and utilizing an online debugger that data the on-the-fly adjustments.
First it deletes the unique content material of the HMTL web page:
A set of instructions that deletes from view the unique web page content material on the compromised WordPress server web page the customer lands on
…and replaces it with the faux discussion board textual content…
The alternative content material consists of the textual content of the “Questions And Answers” faux discussion board web page
…which additionally incorporates the obtain hyperlink for the primary stage JScript payload:
The obtain hyperlink factors to a php script hosted on a distinct server. This hyperlink delivers the .js file packed right into a Zip archive which contains the primary stage Gootloader payload
The consequence will appear to be a dialog within the weblog feedback by which somebody “asks” a query similar to the search question handed from the Google referrer textual content, a “response” seems from a person account named Admin with the search time period hotlinked to the primary stage JScript downloader, and a followup “response” from the identical “user” who “asked” the preliminary query, thanking the admin who “answered.”
The complete dialog is a fiction. It follows this sample in each Gootloader incident.
A Gootloader faux discussion board web page in German. The supply code of the web page exhibits the hyperlink factors to a file named down.php hosted on a totally totally different server than the one the place the web page seems. The hyperlink marked in purple will hook up with the server that’s internet hosting the first-stage obtain JScript.
The first-stage downloader web site
The faux discussion board web page connects to the primary stage obtain server, the place a PHP script serves the primary stage JScript downloader script.
(We obtained a replica of this script from one other researcher within the safety neighborhood, who needs to stay nameless, beneath TLP:Red restrictions. While we couldn’t use the script we obtained on this weblog put up, we might use traits of the script to hunt for related samples.)
On the server aspect, this file is embedded as a big Base64-encoded information blob, with textual content that begins:
With this info, we might seek for related scripts, utilizing this Yara rule:
rule gootkit_stage1_dl{
strings:
$a = "
This gave us a handful of different variants of the script, with the primary distinction being the obtain URL:
We noticed two mothership addresses, 5.8.18[.]7 and my-game[.]biz within the samples we studied. At the time we initially researched this, the my-game area resolved to that IP deal with (it now resolves elsewhere). Oddly, the compromised touchdown web page code hyperlinks to the area, and the primary stage JScript downloader hyperlinks to the IP deal with.
The first stage obtain script (down.php or be a part of.php or about.php or index.php) merely relays the incoming request to the mothership:
The supply code of the PHP script that delivers the primary stage Gootloader payload
The request despatched to the mothership will return the first-stage downloader JScript packaged in a Zip archive. Because it passes the unique referrer string all the way in which to the mothership, it is going to obtain the unique search phrases, and may return a payload with a file title matching these search phrases, which is what we’ve noticed occurs.
How Gootloader compromises WordPress servers
Near the tip of our preliminary analysis, we discovered an essential piece of details about the doubtless supply of the preliminary compromise of the internet hosting WordPress servers. As we collect extra info, it’s price revisiting prior analysis, which can reveal clues that we didn’t know have been associated on the time.
The writeup describes an assault the place attackers positioned a modified copy of the Hello Dolly plugin within the WordPress uploads listing (e.g. wp-content/uploads/), which they then used to provoke the set up of the malicious WordPress content material.
HelloDolly.php has been a inventory plugin, included with the WordPress self-hosted obtain, for a few years. In any case, modifying this code in a comparatively benign plugin, and leaving it in place on the compromised server, permits Gootloader to function in plain sight whereas minimizing the filesystem adjustments which may reveal a compromise to an alert webmaster.
There are a number of methods by which a menace actor would possibly have the ability to place a file right into a WordPress web site: The credentials for the net server might need been phished or stolen; a WordPress element might have had a vulnerability that permitted distant customers to carry out SQL injection or command execution exploits on the host server; the executive WordPress password might need been stolen.
In this case, the writeup incorporates a screenshot:
Screenshot of the modified HelloDolly.php script (courtesy of the Rich Infante weblog)
We searched VirusTotal for extra of those information:
content material:"dolly_css"
While we discovered a number of clear, unique variations of the HelloDolly.php file…
Here, the malicious HelloDolly PHP script is put in as a WordPress plugin beneath the trail:
wp-contentpluginsHello_DollyHelloDolly.php
Another format of the modified HelloDolly.php script exhibits the distinctive identifier string
The malicious PHP information present the extra code, together with the unique Hello Dolly lyrics. An inserted code will verify the POST request for particular parameters, and if discovered, will execute the submitted set up code.
A variation on the Gootloader-modified HelloDolly.php script
We discovered different variations the place the $dolly variables are renamed $wp
A screenshot that summarizes the modification course of Gootloader makes use of (picture courtesy of the Rich Infante weblog)
We discovered these parts within the SQL database dumps, giving us sufficient confidence to ascertain that this was (at the very least) a technique the attackers compromised these professional WordPress websites to show them into distribution servers.
A WordPress database dump incorporates the identical components that the Rich Infante weblog references
Unfortunately, as a result of this has all been maintained on a server that’s straight managed by the menace actors, no matter supply code it could include shouldn’t be obtainable to researchers.
Disturbingly, since 2018 when Gootloader first appeared on the scene, it has used the identical area, and for many of that point, the area pointed to many of the similar IP addresses.
5.8.18[.]7
The my-game[.]biz area resolved to this IP deal with for a number of years. Many of the malicious scripts level straight at URLs hosted on this IP deal with to ship parts of the an infection.
Known URLs:
http://5.8.18[.]7/filezzz.php
The preliminary parts of the an infection are information generally known as Gootkit. They are normally simply PHP scripts that include a base64-encoded string and a script to decode the information and output it to a variable, resembling this file (variably known as be a part of.php or down.php).
The encoded type of a PHP script that delivers the .js payload
We have been additionally capable of establish a number of Gootkit information that confer with, or hyperlink to, this IP deal with, together with this script, and this script. Both of those information include error messages that confer with one thing not with the ability to fully obtain a element.
A screenshot of a file uploaded to VirusTotal exhibits references to the IP deal with previously used to host the Gootkit/Gootloader “mothership” server
Interestingly, the server-side downloader script was named file_tmp_41.php, which is not like the downloader scripts seen usually. That might point out this script was an artifact of testing.
If we pivot off of this info, and (for instance) search VirusTotal for content material:” . The consequence yields additionalinformation, each of which include a URL that we’ve beforehand mentioned:
This was one other deal with that my-game[.]biz has resolved to prior to now. We have been capable of finding one other first-stage Gootkit element that hyperlinks on to this IP deal with.
91.215.85[.]52
Yet one other IP that has been used to host my-game[.]biz and continues to take action. We discovered nonetheless one other first-stage Gootkit script that hyperlinks to this IP deal with.
my-game[.]biz
The web site is clean now, however the Internet Archive reveals an attention-grabbing origin story to this area: In 2014, it was used to host a Russian on-line playing web site. Since 2018, the web page has hosted no different content material however has been linked to the Gootkit/Gootloader malware.
The my-game web site because it appeared in 2014, a Russian-language playing web site known as “Casino Game Life”
The solely different reference we might discover to the area was a Counter-Strike clan listing relationship again greater than 15 years.
The my-game area that continues to host the Gootkit/Gootloader mothership initially belonged to a German staff that performed the sport Counter-Strike competitively
The listing lists this web site as the house web page for a bunch of “semi professional” gamers primarily based in Germany who performed beneath the deal with #mY-GaMe.
Name: #mY-GaMe
Clan-Tag (Kürzel): #mY-GaMe`
Land (Hauptsitz des Clans): Deutschlandweit
Ort (Hauptsitz des Clans): Deutschlandweit
Leader: pr0nb1tch
ICQ#: 256558686
Homepage: http://www.my-game.biz
Anzahl der Spieler: 10
Art der Spielmodi: Leaguez
Clan-Profil: Semi-Profi-Clan
Clan sucht neue Spieler: Ja
Leader: kevin.goe@on-line.de
Open-source intelligence reveals so much
With a malware an infection methodology seemingly designed to make it as tough as attainable for researchers to dig in and study the way it works, Gootloader stays one of the vital pernicious and difficult-to-study threats on the internet.
However, regardless of most of its code current and operating within different folks’s WordPress servers, the proliferation of on-line evaluation instruments supplies a wealthy pool of alternative to learn the way the malware works, and the way its loader delivers payloads. Thanks to the sources uploaded by quite a lot of totally different analysts and researchers, we’ve been capable of construct an almost full image of how the malware operates.
The PHP scripts, embedded JavaScript parts, and downloadable JScript payloads of this an infection are actually nicely understood, and but the malware continues to have an effect, greater than six years after it was first found. Fortunately, as a result of comparatively sluggish tempo of the malware’s growth and its comparatively secure internet hosting of the “mothership” server, static and dynamic detections stay efficient.
And a last be aware about collaborative analysis initiatives. It pays to develop and keep relationships with the malware evaluation and safety analysis neighborhood. For this venture, we obtained assist from a number of researchers, a few of whom didn’t wish to be acknowledged. Our recommendation: If you do this sort of work, don’t hesitate to share your findings; you’ll discover that the hassle you spend money on collaboration with colleagues throughout the business will finally repay once you want info. We are grateful for the assist and assist we obtained from a number of people.
Acknowledgments
Sophos X-Ops gratefully acknowledges the contribution of Marv Ahlstrom, an search engine marketing professional who suggested us about varied points of Gootloader/Gootkit’s malicious search engine marketing. The writer additionally needs to thank the pseudonymous researchers who use the handles @sS55752750, @SquiblydooBlog, and @GootLoaderSites for his or her help. We additionally acknowledge and are grateful for analysis beforehand revealed by Sucuri and Rich Infante. X-Ops researcher Andrew Brandt contributed to this evaluation.