Malware Domain List

Malware Related => Malware Analysis => Topic started by: Edgar Bangkok on October 05, 2010, 03:13:13 am

Title: Italian compromised sites
Post by: Edgar Bangkok on October 05, 2010, 03:13:13 am: This is list of some italian sites (joomla) i found compromised

Code: [Select]
atlantidepulizie.it bisteccheriadabaffo.it contract.tregima.it lasabina.it plexiglassarredo.it aeroclubmontegrappa.it anselmimaurizio.it bluetux.it chirurgiaesteticasalus.it drigani.it fabbromeccanica.it formazionemantova.it hostinghousing.it hotelorazia.it htfpen.it ideapopolareonline.it ideebagno.it itrefratelli.it liparieolie.it magentalab.it marchesecostruzioni.it meteogardolo.it registrazionedeidomini.it
with the homepage contains some links to included pages fake layout file search online

Many of sites in list have also in home this strange script

Code: [Select]
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <SCRIPT type="text/javascript">  </SCRIPT> <base href="http://www.hotelorazia.it/" /> <meta http-equiv="content-type"
that is unknown to me.

Any suggestions?

many thanks

Edgar from Bangkok :)
Title: Re: Italian compromised sites
Post by: extrexploit on October 06, 2010, 12:05:15 am: Hi Edgar,

I have try to deobfuscate the injected code that you have reported. In my honest opinion I think that the compromized hosts are used for black hat seo activity for ranking a fake web based file sharing site. I follow the url that is referenced by the script (with mlk object at bottom of web pages) seem lead to a yet black listed as credit card fraud. I'm posting something about on my blog: http://extraexploit.blogspot.com. If you are interested you are welcome.

Thank you very much for your attention.

Regards
Title: Re: Italian compromised sites
Post by: Edgar Bangkok on October 06, 2010, 01:07:31 am: Thank you very much for decoding the script.
I've never seen a similar script in the past.
The Italian sites affected are different and have their pages included internal file search engine.
Then I write a post on my blog about analisys IT sites and about your analysis of the script with references to the decoding of the script.

Edgar

http://edetools.blogspot.com/ (http://edetools.blogspot.com/)
Title: Re: Italian compromised sites
Post by: Edgar Bangkok on October 06, 2010, 07:59:14 am: I think this action of seo poisoning, which i analyzed through a Google search has very high numbers

Just i using this simple Google dork

Quote
"free full download" modules/com porn

and i find a huge number of references on Google

The results indexed by date show the recent action of seo poisoning (6 hours ago)

Edgar
Title: Re: Italian compromised sites
Post by: extrexploit on October 06, 2010, 08:13:46 am: Hi Edgar,
some news about the obfuscated code. A user from Japan has reported that the code above use a method called "jjencode". He has comment my post reporting his website where is possible
encoding javascript in this mode.

Here the link
http://utf-8.jp/public/jjencode.html

Regards
Title: Re: Italian compromised sites
Post by: Edgar Bangkok on October 06, 2010, 08:48:11 am: Very interesting
I go to see and next i update my blog with news.

Edgar :)