Huntress Traces SocGholish Infection from a Compromised WordPress Site
Summary
Huntress traced a SocGholish download through a compromised WordPress blog by reviewing Chrome history and analyzing an obfuscated script, identifying more than 100 potentially compromised domains.
Key points
- Investigators used a suspicious Update.js file to identify Chrome as the originating browser and examined its history and download records.
- Chrome history showed the file was downloaded after a visit to a hacked WordPress blog that redirected visitors to SocGholish-hosting infrastructure.
- The researchers de-obfuscated the script to examine its next-stage requests and used URL scanning to find more than 100 potential compromised domains.
- The article describes reviewing the evidence and reporting findings to the customer; it does not state that all identified domains were confirmed compromised.
Article Details
- Attack Vectors
- Social engineering using fake software updates to persuade users to download and run malicious JavaScript.
- A hacked WordPress personal blog redirected visitors to a separate site hosting the malicious JavaScript.
- Defensive Notes
- Review browser history and download records to identify the source of a suspicious JavaScript file.
- Use SQLite3 to extract entries from the browser history downloads table.
- Analyze suspicious scripts and their subsequent-stage network requests; the article recommends URL Revealer from Kahu Security as an investigative aid.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | assay[.]porchlightcommunity[.]org | Domain hosting the obfuscated SocGholish script and subsequent-stage resources. |
| URL | hxxps[:]//assay[.]porchlightcommunity[.]org/3TLWUaYQtTi5EOxj6wr6c65GsyH/CPQws1O6KKdXiTetEPpzrxDsc7lZoz2sXL4+s1ihJbtIsz2kRqMp/08= | Next-stage resource on the domain identified as hosting the malicious script. |
| URL | hxxps[:]//assay[.]porchlightcommunity[.]org/kbI7y+qQWKL1kAH5p4oX6eLGXruziBm749dYo/TRUJT7wWSt491Vv/TASaTjkBfp9MBJpOOQAfq9kEnpq5BNp/bLGbY= | Next-stage resource on the domain identified as hosting the malicious script. |
| URL | hxxps[:]//assay[.]porchlightcommunity[.]org/Q7kAIzibY0onmzoRdYEsATDNZVNhgyJTMdxjSybaa3wpyl9FMdZuVybLckwxmywBJstyTDGbOhFvm3IBeZtjVmHE | Next-stage resource on the domain identified as hosting the malicious script. |
| URL | hxxps[:]//racerex[.]com/its-fire-up-season/ | URL identified in browser history as the source of the redirect from a compromised WordPress blog. |
MITRE ATT&CK
People
Malware
Vendors
Products
Google ChromeUpon noticing a user running a suspicious JavaScript file named Update.js, our first step at Huntress is to identify the originating browser. In this case, it’s Google Chrome.WordPresssuspicious domain https[:]//racerex[.]com/its-fire-up-season/. Taking a scan of this website revealed a WordPress site of someone's personal blog that had been hacked to redirect users without their knowledge to the
Tools
sqlite3Utilizing tools like SQLite3, we analyze the browser history. For those unfamiliar, SQLite is a database engine that can be easily navigated using specific commands. Within the Terminal you can open a History file byURL RevealerSpecial thanks to Mehtap Ozdemir (US team Huntress) for recommending the URL Revealer tool from Kahu Security. This tool, alongside running the suspicious Update.js file, can unveil the domains the file communicates