3 ms·

I've seen this. This is the same basic payload/TTP from the regional news sites that were compromised (via shared scripts hosted by McClatchy and MediaNews) a f

I've seen this. This is the same basic payload/TTP from the regional news sites that were compromised (via shared scripts hosted by McClatchy and MediaNews) a few years ago (2019). Op needs to hit the site with a new IP and with a 'referer' to get the second stage. There is also some JS fingerprinting, like checking GPU model, to ensure a plausible client visit. This was a fun piece of malware to dissect. I believe Symantec classified it as SocGholish. Edited: clarity, details

aviditas 4y ago
The last batch of SocGholish I encountered had virtualization checks on each stage and required user interaction to run/open the payload. Used iframes or modified google analytics on the compromised site and used webpress plugins vulns to get access. The sandboxing checks were crazy good. I ended up getting an old laptop to do the analysis as it detected every other security sandbox tool. The only positive is that the payload (6 months back) itself is easily detected by most edr. Defender caught it on download. +1 to the enjoyable dissection. Rooting out the underlying infra was also very fun.