id: balada-injector-malware

info:
  name: Balada Injector Malware - Detect
  author: kazet
  severity: high
  description: |
    Checks websites for Balada Injector malware.
  reference:
    - https://blog.sucuri.net/2024/01/thousands-of-sites-with-popup-builder-compromised-by-balada-injector.html
  metadata:
    max-request: 1
  tags: malware,balada,misc,miscellaneous

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    redirects: true

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - '(?mi)sgpbWillOpen", *function\(e\) *{if *\(e[.]detail[.]popupId.{0,100}eval.{0,100}atob'

      - type: word
        part: header
        words:
          - "text/html"
# digest: 4b0a00483046022100bfaaa561ee89f012928825ca6cd80f14ee1e44ec80a5e3c0328577bc7255c62b022100c18a946678c0322319edf95a1ed5c7f9c945bd1d7c00c9a91cec4fc58151c9e8:922c64590222798bb761d5b6d8e72950