Thread by @JCyberSec_

:: Magecart Hunting Thread ::

This is a thread about how to hunt and find #Magecart infected sites using @URLscan. 💰💵

♻️Please retweet to help spread knowledge and feel free to add your own techniques, ideas, and suggestions.

⚠️THREAD⚠️

A brief overview of Magecart.

Magecart is an umbrella term for the technique of injecting JavaScript to steal credit card numbers on E-commerce sites. A number of actors/groups operate under the same term implanting JavaScript onto checkout pages all over the world.

To get started we need a foothold.
I have a hunt running looking for a known Magecart hash.

This morning a new site hit the search, looking at the site I then used the filename as a pivot. The filename which is infected with Magecart is "jquery_noconflict.js"

Using this filename as a pivot we can find other sites using a file with the same name.

The second site listed ':/www.shopatsimba.com' requires further analysis I think.

Initial analysis needs to check the domain tree to see what domains the site calls out to when loading.

There are three which require further analysis:
- :/images-amazon.com
- :/jquerycdnlib.at
- :/gnogle.ru

It turns out, 'images-amazon' is legitimate and owned by Amazon.
Sadly, the same can't be said about the other two domains identified which appear highly suspicious.

Starting with 'gnogle' - The site returned 0 Bytes, so for now this site is a dead end; however, it is worth keeping in mind and using as a pivot for another investigation in the future.

Moving our attention to 'jquerycdnlib'

URL🌐- hxxps://jquerycdnlib.at
IP - 217.8.117.42
TLS🔐- @letsencrypt

Looking at the HTTP resources on the e-commerce site for the transaction details to the domain that is being analysed.

The file requested from this domain is called '5c3a398f10058.js'

Looking at the JavaScript code it becomes clear this is a Magecart script, it searches for credit card information, and then sends this data back to the domain it was loaded from.

Without fully deobfuscating the script we will not know the full capabilities of the script. However, it is clear at this point that 'shopatsimba' is infected with Magecart and all card details are being stolen when they are entered into the site.

We can continue to hunt this script using the hash, the file name, and also looking into the IP address to see if any further scripts can be found.

But that is for you to do!

If you have any questions or want to chat, my DM's are open to enable me to talk to cool people.

If you enjoyed this thread then why not check out my other threat hunting threads:
-

https://twitter.com/JCyberSec_/status/1130793084957134848

-

https://twitter.com/JCyberSec_/status/1156545729952976896

Please see the above thread which may be of interest to you. Retweets would be great. Thanks!

@malwrhunterteam @jknsCo @dave_daves @nullcookies @dvk01uk @cybsecbot @JackRhysider @SecurityNewsbot @RiskIQ @Ring0x0 @ydklijnsma @Aamog @BleepinComputer @proofpoint @SteveD3 @ANeilan

@malwrhunterteam @jknsCo @dave_daves @nullcookies @dvk01uk @cybsecbot @JackRhysider @SecurityNewsbot @RiskIQ @Ring0x0 @ydklijnsma @Aamog @BleepinComputer @proofpoint @SteveD3 @ANeilan Please see the above thread which may be of interest to you.

♻️Retweets would be appreciated to help knowledge share!

Thanks.

@SINON_REBORN @echobit @three_cube @ThisIsNuse @pry0cc @malware_traffic @NarimanGharib @darienhuss @kfalconspb @RH_Poseidon @JAMESWT_MHT @kfalconspb