id: balada-injector-malware

info:
  name: Balada Injector Malware - Detect
  author: kazet
  severity: high
  description: |
    Checks websites for Balada Injector malware.
  reference:
    - https://blog.sucuri.net/2024/01/thousands-of-sites-with-popup-builder-compromised-by-balada-injector.html
  metadata:
    max-request: 1
  tags: malware,balada,misc,miscellaneous

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    redirects: true

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - '(?mi)sgpbWillOpen", *function\(e\) *{if *\(e[.]detail[.]popupId.{0,100}eval.{0,100}atob'

      - type: word
        part: header
        words:
          - "text/html"
# digest: 4b0a004830460221009d0a09450b15cc14f4379a5ce44eb47d59ad4ea956b3c88ddb6323238cbb9dc4022100bb40ac297c7e62fc084617b7dd70d09f5ee6a497fb2da05efb964589ac5a3aa8:922c64590222798bb761d5b6d8e72950