Understanding Recent Blackhole Exploit Kit's "js.js" Infector Trend for Smart Hunting


When I hunt honeypot blackhole exploit kit (BHEK) blacklist
for infections I often come to see some URLs ending up with js.js on it.
The file will be the same in extention but actually it has differences in
contents depend on malware epidemic exploitation / how the BHEK want to
infect users at that time.

Previously, the trend I found in the js.js code was a mere and
common injected obfuscation script like :

or

↑It was obvious that we must crack this code for getting to the next -
hop of the malware source.

But the recent js.js that I found was mostly/practically a javascript calls to
another text file contains "document.location=" of a certain blackhole sites.
The moral of this writing is, we can nail bigger stuffs / new epidemic by
understanding the parameter produced by the recent terms.

Allow me to demonstrate this theory. Let's see the below real infected urls:
209.215.118.13 hXXp://209.215.118.136/fFDrSXRM/js.js
200.219.245.75 hXXp://aainstalacoeseletricas.com.br/3XmimsHL/js.js
184.107.196.218 hXXp://www.celucentro.com.co/qgmZiWk7/js.js
82.98.87.89 hXXp://wilde.webprojekt.ch/v8bPW1U4/js.js
85.214.26.149 hXXp://advantage-media-sports.com/26MxXngr/js.js
194.170.160.46 hXXp://www.admirals.ae/mC9o9rRd/js.js


This will connect you to the certain "document.location=" below:
document・location='hXXp://209.59.222.20/pxyk80ujzb03h.php?y=pju39rz4qpnogd84';
document・location='hXXp://50.116.54.37/pxyk80ujzb03h.php?y=p7tqagmzf8qdjqpi';
document・location='hXXp://173.230.130.248/pxyk80ujzb03h.php?y=078eb263358008ea';
document・location='hXXp://69.163.40.128/pxyk80ujzb03h.php?y=p7tqagmzf8qdjqpi';
document・location='hXXp://69.163.40.128/pxyk80ujzb03h.php?y=gawit01smae175m0';
document・location='hXXp://69.163.40.128/pxyk80ujzb03h.php?y=pju39rz4qpnogd84';


The lesson teach us to understand the curent trend of parameter used in
blackhole, which is :
/pxyk80ujzb03h.php?y=


Let's proof this theory by searching the above strings in the -
malware domain list site:


↑*) Click to enlarge the pic

↑Voila! We got ourself a new hunting field. :-)
PS: This posts is dedicated to fellow malware hunters
#MalwareMustDie!