Digging Deep Into Magecart Malware
Last week, one of my SpiderLabs colleagues was working on a PCI forensic triage for a website. During his investigation, he asked me to check out some HTTP traffic he captured during an online retail store checkout session.
This was the HTTP capture:
At first glance, the GET request is very suspicious. Firstly, the HTTP Referer URL path contains “/checkout/onepage” (a very common URL target path of Magecart attacks). Secondly, the GET request is to a third party domain (mxcounter.com). And thirdly it requests a “.GIF” file followed by a long Base64 encoded string.
So I immediately decoded the Base64 string which resulted in the following :
Some obvious data exfiltration is going on there!
Next, I investigated and checked the HTML source code in the checkout page and found this JavaScript at the bottom of the webpage which was not obvious at first:
De-obfuscating the code results in something like this:
Basically what this script does is:
- check if the current page URL location contains the string ‘out/onepag’ (concatenated checkout/onepage)
- create a