Rewterz Threat Alert – Cookie Monster Malware Hijacking WordPress Sessions

October 10, 2019

Severity

Medium

Analysis Summary

A malware attack is observed injecting obfuscated code into a JavaScript file in order to steal web users’ cookies and hijack their WordPress sessions. The malicious script was discovered during an incident response investigation and included the fake, malicious domain “code.wordprssapi[.]com”, where users’ cookie data was sent. Hackers used a typo-squatting strategy to create a domain that looked very similar to that a real, legitimate web service in order to evade detection. However, the properly spelled version of this domain “code.wordpressapi[.]com” is also unrelated to WordPress.

Impact

Information Theft
Code Execution

Indicators of Compromise

Domain Name

abtrcking[.]com
upgraderservices[.]cf
traffictrade[.]life
flipdigital[.]ru
stablemoney[.]ru
cleantds[.]in
dezaula[.]com
bwinpoker24[.]com
livestats[.]us
mediros[.]ru
yourmsrp[.]com
onlinemarketplace[.]top
pipardot[.]com
beatchucknorris[.]com
adrenalinecdn[.]com
blozoo[.]net
oasagm82wioi[.]org
hosted-oswa[.]org
getsocialbuttons[.]xyz
trafficapi[.]nl
zirve100[.]com
nstracking[.]com
dcts[.]pw
airjss[.]com
sbdtds[.]com
jquery[.]im
ijquery9[.]com
upskirt-jp[.]net

Hostname

con1[.]sometimesfree[.]biz
www[.]caphyon-analytics[.]com
src[.]dancewithme[.]biz
1[.]newor[.]net
gamescale[.]vio[.]rocks
a01[.]u-ad[.]info
log[.]widgetstat[.]net
3[.]newor[.]net
i[.]omeljs[.]info
js2[.]sn00[.]net
themes[.]affect[.]lt
b[.]nwcdn[.]xyz
i[.]rfgdjs[.]info
www[.]rarstats[.]com
cdn[.]avrti[.]xyz
chat-client-js[.]firehoseapp[.]com
m[.]free-codes[.]org
tag[.]imaginaxs[.]com
cdn[.]muse-widgets[.]ru
i[.]selectionlinksjs[.]info
cdn[.]echoenabled[.]com
sdb[.]dancewithme[.]biz
earsham[.]pontypriddcrick[.]com
c[.]radxcomm[.]com
java[.]sometimesfree[.]biz
api[.]behavioralmailing[.]com
www[.]kanpianjs[.]top
cdn[.]jquery[.]tools
www[.]seo101[.]net
www[.]andrewandjack[.]com
webstats[.]xcellenzy[.]com
st[.]stadsvc[.]com
infinite-2[.]tcs3[.]co[.]uk
www[.]yys1982[.]com
i3[.]putags[.]com
stat[.]botthumb[.]com
js[.]sn00[.]net
st[.]segpress[.]io
m[.]xfanclub[.]ru
daljarrock[.]hurlinesswhitchurch[.]com
cdn[.]owlcdn[.]com
da[.]adsvcs[.]com
cfs[.]u-ad[.]info
srv1[.]clk-analytics[.]com
infinite-3[.]tcs3[.]co[.]uk
dup[.]baidustatic[.]pw
www[.]spartan-ntv[.]com
static[.]bh-cdn[.]com
d0[.]histats[.]12mlbe[.]com
www[.]ournet-analytics[.]com
s1[.]omnitor[.]ru
connect[.]f1call[.]com
www[.]frompariswithhate[.]org
2[.]api[.]viralheadlines[.]net
www[.]agrkings[.]com
keit[.]kristofer[.]ga
parts[.]kuru2jam[.]com
code[.]jguery[.]org
widgets[.]wowzio[.]net
js[.]nster[.]net
script[.]affilizr[.]com
cdn[.]inaudium[.]com
e[.]e708[.]net
narnia[.]tcs3[.]co[.]uk
js[.]trafficanalytics[.]online
www[.]takoashi[.]net
w5983[.]lb[.]wa-track[.]com
cdn[.]adpoints[.]media
stat[.]rolledwil[.]biz
s[.]orange81safe[.]com
www[.]hmailserver[.]in

Remediation

Block the threat indicators at their respective controls.
Do not visit suspicious looking sites.