---
# System prepended metadata

title: Generic malware detection patterns

---

# Generic malware detection patterns

## Backend code

- gz header in non-gz file
- Random var/func names of exactly 16/32 chars `$pojnekdohucyiyur(($gbqjmsxsbwfjdajm`
- curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
- Unformatted code `;function`
    - /.{500}/ regex
- Formatting error (space vs tabs)
- Disabling of error reporting
    - @ini_set("error_log",null);@ini_set("log_errors",0)
    - ;error_reporting(0);
- PHP silence operator
    - @eval
    - @file_get_contents
- Check for var names with 1 char uppercase variations `$hBcS('onfr64_rapbqr')`
- Long lines/strings: `[^\n]{140}` or `[\S]{140}`
- External mail address: `grep --color=none -rP '\w{3}@\w{3}'  . | egrep -v '@(example|swiftotter|webtexsoftware|opencommercellc|paradoxlabs|vandyke.com|libssh.org|php.net|domain.com|domain.tld|magentocommerce.com|zend.com|author|copyright|magento.com|varien.com)'`
- Find large files (exfil storage?) > 10MB
    - Find growing files
    - Find image files with incorrect image header (mime)
- Find direct access to input vars: `grep -rP '\$_(REQUEST|POST|GET|COOKIE)' .`
- Find files with mtime < ctime
- Suspicious PHP functions: `grep -rP 'base64_encode|shell_exec|str_rot13|die|goto|create_function'  .`
- Credit card references: `grep -rP '\bcc_' .`
- Standard store framework: 
    - compare found core files to expected core files
    - compare found core filesizes to expected core filesizes


## Log analysis

- db name is present in access logs
- same ip in short timeframe in access logs
- high volume of requests on access point
- suspicious UA (old ua, ua changes constantly for same ip)
- suspect country codes (RU, UA, CH etc)

## Frontend

- file size/content changes when on checkout
- file size/content changes when different UA and/or ip location
- detect outbound requests initiated by site
- html elements with scripts in tags (onload='\<script\>')
- html elements which are created but have no position/representation (could be many fpos for tracking tho)
- detection of leading spaces (used when attacker wants to hide code when viewer has no wraparound)
- comparison of *some* popular widgets/scripts to what is found (ex: we can compare what a google script should be like with what is present)
    - Google/Facebook
    - Chat scripts (zopim)
- unexpected filenames or files in unexpected dir


## Front- & Backend

- Literal string concatenation: `'+'`, `"."` (plus any whitespace)
- Base64 source: `[a-z0-9]{70,}`+ automatic decoding
- Detect too much whitespace or newlines
- Detect unexpected formatting of code style
    - No newlines in context of code with newlines
    - Minification/obfuscation
    - Inconsequent use of var/func naming or style
- Detect unusual UTF-8 characters


## Manual checkout inspection

- Use devtools regex or `curl -sL <site> | grep -P` to find:
    - Long strings of spaces, trying to hide something out of view
        - `[^ ] {30}`
    - Long strings of newlines, often indicating injection
        - ???
    - Very long lines, often indicating injection
        - `.{10000}`
    - Base64 strings
        - `[a-z0-9]{70,}`

## Specific searches

- Find stacks of curl_setopt
    - `grep -rP '(curl_setopt\(\$.{2,30}, CURLOPT_.{5,60}\n\s{0,50}){6,12}'`
- Find everystylish codestyle
    - `grep -rP '\.\.\. .{10,30};;`