❌

Reading view

Bengal cat lovers in Australia get psspsspss’d in Google-driven Gootloader campaign

Security Operations – Sophos News

By:gallagherseanm

6 November 2024 at 05:30

The Internet is full of cats—and in this case, malware-delivering fake cat websites used for very targeted search engine optimization.

Figure 1: An SEO-poisoned site hosting a malicious .zip file

Figure 2: A log of running processes, including the execution of wscript.exe to launch the second stage via a scheduled task.

Figure 3: A scheduled task is created to launch the second stage JavaScript.

Figure 4: A PowerShell command line spawned by CSript.exe

Figure 5: PowerShell reaching out to various URIs

Figure 6: Sandboxed browser (Browserling) results when accessing the website and clicking on the malicious hyperlinked URL

Figure 7: The Strings output of are bengal cats legal in australia 72495.js

Figure 9: Mandiant’s python script for auto-decoding GootLoader’s JavaScript displays the output of Are_bengal_cats_legal_in_australia_72495.js

Figure 10: The process Monitor CreateFile event for WScript.exe upon execution of Are_bengal_cats_legal_in_australia_72495.js

Figure 11: Process behavior observed within Source Forge's Process Hacker

Figure 12: Process Hacker process properties and Scheduled Task creation

Figure 14: Malicious domain names observed within DNS requests through Wireshark PCAP

Gootloader inside out

Threat Research – Sophos News

By:Gabor Szappanos

16 January 2025 at 11:00

Open-source intelligence reveals the server-side code of this pernicious SEO-driven malware - without needing a lawyer afterward

A list of Gootloader JScript filenames, which correspond to the search query that led victims to download them

Gootloader has poisoned search results in multiple languages, including German, French, and Korean

Source of the Gootkit/Gootloader landing pages reveal a number of different search terms and phrases the threat actors wanted search engines to index. The linked subpages (selected with green) don't actually exist. The injected WordPress code defines a few hooks, one of them is for non-existing pages. This will serve the fake forum discussion, when the victim clicks on the search result

A screenshot of the source code from a Gootkit/Goodloader landing page. Image courtesy of Sucuri Research.

The WordPress database dump included this table that contains a set of the first three octets of IP addresses, a block list of IP ranges that cannot revisit the Gootloader website on the same day

A block of base64-encoded data stored as a variable named $pposte in a WordPress database

Malicious SEO content phrases embedded in a WordPress database table, linking the site to an Excel spreadsheet converter search query

The "place marker" string appears in the OpenGraph metadata SEO headers of a Gootkit/Gootloader-modified web page

Files that contain references to the Gootloader "mothership" website (screenshot courtesy of VirusTotal)

Commented text, preceded with double slashes, documents the Gootkit characteristics of modified web pages

a WordPress database dump in VirusTotal

A SQL dump from a compromised WordPress installation contains base64-encoded elements of the Gootkit/Gootloader modifications

The decoded base64 data from the WordPress database reveals the PHP script that handles decoding the malicious content for a site visitor

A simple command shell Gootkit inserts into the PHP running in a WordPress site the threat actors have comrpomised

The portion of the Gootkit code that collects the HTML content of the fake page it will later draw over the top of the compromised website

The Gootkit code blocks repeat visitors by adding not only the visitor's IP address range to a block list, but the entire class C IPv4 address range on either side of the visitor's address, just for good measure

The Gootkit/Gootloader fake forum page, featuring a "question" and an "answer" that links to the Gootloader JScript first-stage payload

The unique key is linked in a Javascript code snippet embedded in the compromised WordPress server page.

A set of commands that deletes from view the original page content on the compromised WordPress server page the visitor lands on

The replacement content includes the text of the "Questions And Answers" fake forum page

The download link points to a php script hosted on a different server. This link delivers the .js file packed into a Zip archive which comprises the first stage Gootloader payload

A Gootkit/Gootloader fake forum page in German. The source code of the page shows the link points to a file named down.php hosted on a completely different server than the one where the page appears. The link marked in red will connect to the server that is hosting the first-stage download JScript.

The source code of the PHP script that delivers the first stage Gootloader payload

Screenshot of the modified HelloDolly.php script (courtesy of the Rich Infante blog)

Another format of the modified HelloDolly.php script shows the unique identifier string

A variation on the modified HelloDolly.php script

A screenshot that summarizes the modification process Gootloader uses (image courtesy of the Rich Infante blog)

A WordPress database dump contains the same elements that the Rich Infante blog references

The encoded form of a PHP script that delivers the .js payload

A screenshot of a file uploaded to VirusTotal shows references to the IP address formerly used to host the Gootkit/Gootloader "mothership" server

The my-game website as it appeared in 2014, a Russian-language gambling site called "Casino Game Life"

The my-game domain that continues to host the Gootkit/Gootloader mothership originally belonged to a German team that played the game Counter-Strike competitively