We have been tracking an interesting malware that is affecting thousands of compromised sites. We call it GetMama!!
Why conditional? Because instead of just displaying the malicious code to all the visitors of the web site, it connects back to its command and control server to find out what to do. It also sends back to the attackers the IP address, user agent and referrer of the person visiting the compromised site, so the command and control can determine if it should display the malicious content or not.
It also only displays the malicious content once a day per IP address and only to Windows users.
Why GetMama? Well, that’s how the malware authors called their own function (see sample in the bottom of the post).
COMMAND AND CONTROL (C2) SERVERS
Those are the command and control IP addresses. I recommend checking for traffic to these IP addresses and blocking them if possible:
78.46.173.14
176.9.218.191
91.228.154.254
77.81.241.253
184.82.117.110
46.4.202.93
46.249.58.135
176.9.241.150
46.37.169.56
46.30.41.99
94.242.255.35
178.162.129.223
78.47.184.33
31.184.234.96
For every request to the compromised sites, there will also be a random call to one of those. The called URL would look something like http://31.184.234.96/jedi.php?version=0991&mother=
MALICIOUS CODE
This is final decoded malware that gets executed on the compromised sites. For every request, it connects back to the attackers to determine what to do. The action could be to inject malware in the site, run a command in the server (it also acts as a backdoor) or to do nothing.
HEAVILY ENCODED
Note that the malware will not look like that (all pretty) on the compromised site. It can be encoded like this:
$VDNjO60q6FJNnaRjb6MS3d5d= array(‘7920′,’7937′,’7916′,’7927’);$eVlnlmOOZXsWOJTjjxwj=
array(‘3733′,’3748′,’3735′,’3731′,’3750′,’3735′,’3729′,’3736′,’3751′,’3744′,’3733’,
‘3750’,’3739′,’3745′,’3744′);$albi35lY8fkUqy5DcKtZ2gECZNLn=
array(‘5781′,’5780′,’5798′,’5784′,’5737′,’5735′,’5778′,’5783′,’5784′,’5782′,’5794’,
‘5783’,’5784′);$aeMTktRM9OsQRAd5bpDQ7Bmj0ASq2z=”ZXZhbChiYXNlNjRfZGVjb2Rl…JYY683″);
$X7ry2SBupAHs89a1Fj06AYlUg2RO3VPSS6hKOI548Dm =
$V6uPJ50EnFVWUclEHg5TEJpQvcBf6g9XduCNpthDY2qI(‘$wnY8xO4XDfHK8pp1a4KS1RtGqo’,
$VyUF5BmxNFlWXVT3P.'(‘.$adCH8mcHCS3Fj8Bq8otsR6Hae.'($wnY8xO4XDfHK8pp1a4KS1RtGqo));’);
$X7ry2SBupAHs89a1Fj06AYlUg2RO3VPSS6hKOI548Dm($aeMTktRM9OsQRAd5bpDQ7Bmj0ASq2z);}
As you can see, its not using any of the normal “eval ( base64_decode” calls that webmasters are used to looking for. This malware has also evolved and it can be hidden in different ways.
We will post more details as we learn more about it.
Note that if your site is compromised, our free sitecheck scanner may miss this type of malware (because of the conditional way it works). If you think you are compromised, only our internal scans can find/clean it up.
how do we get rid of this? here’s another code i discovered on my site:
It depends, if you have it it’s likely injected itself in every PHP file. In this instance, replacing your core files won’t be enough. You’ll want to try and roll back to a previous version that is a known clean then go about hardening.
i was wondering how did this malware infected our sites, considering all the best efforts of hardening the wordpress installs..
I’ve had this problem too and found the way how to get rid of the virus. I posted the way on my blog here.
I just found malicious code on my sites, after decoding it it did mention the get mama function but it have “eval ( base64_decode” written with it. Some of the IP addresses you mention overlapped with the ones inside the code, mine also contained some new ones. I’ve blocked all of them just in case, hopefully that was the right thing to do.
In my folders, I had a suspicious file called 22.php and it made a list of all the directories inside files called zaza_0, zaza_1 etc. However it didn’t infect any other php files, maybe I caught it just in time?