id: balada-injector-malware

info:
  name: Balada Injector Malware - Detect
  author: kazet
  severity: high
  description: |
    Checks websites for Balada Injector malware.
  reference:
    - https://blog.sucuri.net/2024/01/thousands-of-sites-with-popup-builder-compromised-by-balada-injector.html
  metadata:
    max-request: 1
  tags: malware,balada,misc

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    redirects: true

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - '(?mi)sgpbWillOpen", *function\(e\) *{if *\(e[.]detail[.]popupId.{0,100}eval.{0,100}atob'

      - type: word
        part: header
        words:
          - "text/html"
# digest: 4b0a004830460221009db9351eff51f5f5836d6efcd39c7efdeebc92b6e1d6377f4dcf7b462392205a022100bd9fc7caeb904de7239fdb600bf591636b94165478b02e040a4c84dfea33f57b:922c64590222798bb761d5b6d8e72950