3 ms·
I posted a writeup a few months ago reverse engineering the same code, but hosted on a different website: https://blog.jse.li/posts/marveloptics-malware/ https
by eat_veggies 8y ago
I posted a writeup a few months ago reverse engineering the same code, but hosted on a different website:
https://blog.jse.li/posts/marveloptics-malware/ https://blog.jse.li/posts/marveloptics-malware/
- strictnein 8y agoVery nice work! Best breakdown of the magecart code I've seen by far. edit: One of the clever things they do is have a different response for the GET and POST on what looks to be a JS file: > hxxps://webfotce.me/js/form.js Like with the new one( hxxps://info-stat.ws/js/slider.js ) if you do a GET you just get some innocuous looking JS: jQuery.noConflict(); But the malicious JS posts to that URL as well.
- ashelmire 8y agoGood writeup! Do you know whether the libraries in question were compromised, or were the compromised sites obtaining modified version of the libraries from some other source?