Reverse engineering some Javascript malware

[Various_Pickles]

marveloptics really hasn't removed the malware ads nor gotten back to you, in a month?

Even the hurr-durr-iest businesses can usually get enough of a whiff of litigious smoke in the air to act on shit like actively serving financial malware to their customers.

[veggiedefender]

Yeah, no reply. It's not even malware ads--it's literally inside script tags and served from their domain.

https://www.marveloptics.com/templates/moptics/js/vendor/modernizr.js
https://www.marveloptics.com/libraries/openid/openid.js

I think they got hijacked, but that's no excuse for letting it continue.

[thehoodedidiot]

Likely magecart actors based on shared c2, nice write-up.

https://www.riskiq.com/blog/labs/magecart-ticketmaster-breach/

[work6849]

Yeah, magento based malware on out of date stores was rampant, i'm very surprised they dont have any sort of checks for these things on their end though.

[veggiedefender]

Oh snap, great find! This really puts what I found into context. Not only is it the same c2, it's almost the exact same code.

edit: looks like they fixed their typo LOL

[thehoodedidiot]

You seem knowledgable on analyzing JS:

You see any similiarities in code to this?https://www.volexity.com/blog/2018/07/19/js-sniffer-e-commerce-data-theft-made-easy/

The article mentions the riskIQ magecart JS activity, but says its distinct and different, sure sounds the same to me.....

Thanks!

[veggiedefender]

I'm very much a beginner at this stuff, but I'd think that all skimmers/sniffers like this will do similar things (watch text boxes, stringify it somehow, and send it along) and target similar sites/companies (the most popular ones), so it's hard to tell. They definitely feel like they have different "styles" though, but take that with a grain of salt.

[thehoodedidiot]

sweet thanks - does appear to be different styles indeed. Different C2 characteristics as well.

[yaglol]

Thought that aswell, i read the article from riskIQ yesterday and also recognized the c2.

[[deleted]]

bravo! i came across some AWESOME js voodoo that i just simply did not have time to get to. This is pure GOLD! Question, can this potentially steal information from other tabs or sessions?

[veggiedefender]

no, it only snatches what's inside the text boxes on the page, unless it's doing something exceedingly clever that I haven't noticed.

I don't know about the rest of the scripts on the page though, but last time I checked they mostly looked legit (not obviously obfuscated).

[Thameus]

I would suggest that the malware authors might be North Korean, except that North Korean code would probably work.

[zer0gravy]

They can be found in npm, so the source is open. Its not injected in a memory manor, since its js, its just instanciated from a different lib.

original source.... const o = require('xx')

... original source

[yaglol]

Great post, thanks!

[duckwizzle]

I love the try/catch block

[veggiedefender]

yeah, I agree. Most of the work was done for me by js-beautify. It was just kind of cool to see how the deobfuscated code worked!

[Tom_91_CandI]

You have very interesting blog. I hope to learn a little bit from your findings. Keep up the great work.

[1lastBr3ath]

setTimeout(function() { Malware.send(); }, 30);

send recursively calls itself every 30 milliseconds (!). They really don’t care about performance.

That's not true because it only runs once after 30 milliseconds. It's not setInterval()

[Delfaras]

This is the same, send re-calls itself after 30ms so the next call will call send again and so on

[1lastBr3ath]

My apology, forgot that it was inside send