Malware Analysis CashU.com site compromised ?

[Divine_Barakah]

Today I was trying to order a virtual MasterCard from cashu.com . When I opened the website Kaspersky flooded me with notifications. I have attached Kaspersky's report.

 

[L0ckJaw]

Yup Eset also the same, 23 notifications !

 

[harlan4096]

Maybe a false positive or ...

VirusTotal

VirusTotal

www.virustotal.com

But this specific URL is also detected by my KTS2020b:

​

 

[Divine_Barakah]

This is alarming. This is like PayPal in the Arab world, so no comment

 

[L0ckJaw]

According to Eset it is a Javascript Trojan.

 

[lThinkFreel]

Avast:

 

[Andrew3000]

I tried with Eset on Brave and it doesn't block anything. With chrome 23 pop-messages (JS/Agent.OCJ)

 

[marcopaone]

Same here, with brave no messages but with other browsers appears 23 pop-messages
P.S no brave shield enabled, no third party extension and no script blocking

 

[L0ckJaw]

I used Firefox, immediately intercepted.

 

[JB007]

Hello,
Clean for Norton Safe Web : Report for cashu.com | Norton Safe Web

 

[Moonhorse]

VirusTotal

VirusTotal

www.virustotal.com

 

[Divine_Barakah]

I tried with Eset on Brave and it doesn't block anything. With chrome 23 pop-messages (JS/Agent.OCJ)

Maybe Brave Shields blocked the bad parts of the site?

 

[L0ckJaw]

Hello,
Clean for Norton Safe Web : Report for cashu.com | Norton Safe Web

Norton is always behind.

 

[Divine_Barakah]

For those using Brave browser, is "script blocking" enabled?

 

[Andrew3000]

Maybe Brave Shields blocked the bad parts of the site?

Maybe but I don't know, Because if a scan is made, Eset finds the malicious code in cache files.

Spoiler

C:\Documents and Settings\andre\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\f_00676d JS/Agent.OCJ trojan horse Elimina
C:\Documents and Settings\andre\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\f_00676e JS/Agent.OCJ trojan horse Elimina
C:\Documents and Settings\andre\Impostazioni locali\BraveSoftware\Brave-Browser\User Data\Default\Cache\f_00676d JS/Agent.OCJ trojan horse Elimina
C:\Documents and Settings\andre\Impostazioni locali\BraveSoftware\Brave-Browser\User Data\Default\Cache\f_00676e JS/Agent.OCJ trojan horse Elimina
C:\ProgramData\Microsoft\Windows\Containers\BaseImages\29d8b5d7-1735-4b27-9ca1-9ea12269b252\BaseLayer\Files\Documents and Settings\andre\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\f_00676d JS/Agent.OCJ trojan horse Elimina
C:\ProgramData\Microsoft\Windows\Containers\BaseImages\29d8b5d7-1735-4b27-9ca1-9ea12269b252\BaseLayer\Files\Documents and Settings\andre\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\f_00676e JS/Agent.OCJ trojan horse Elimina
C:\ProgramData\Microsoft\Windows\Containers\BaseImages\29d8b5d7-1735-4b27-9ca1-9ea12269b252\BaseLayer\Files\Documents and Settings\andre\Impostazioni locali\BraveSoftware\Brave-Browser\User Data\Default\Cache\f_00676d JS/Agent.OCJ trojan horse Elimina
C:\ProgramData\Microsoft\Windows\Containers\BaseImages\29d8b5d7-1735-4b27-9ca1-9ea12269b252\BaseLayer\Files\Documents and Settings\andre\Impostazioni locali\BraveSoftware\Brave-Browser\User Data\Default\Cache\f_00676e JS/Agent.OCJ trojan horse Elimina

 

[L0ckJaw]

Maybe but I don't know, Because if a scan is made, Eset finds the malicious code in cache files.

Spoiler

C:\Documents and Settings\andre\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\f_00676d JS/Agent.OCJ trojan horse Elimina
C:\Documents and Settings\andre\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\f_00676e JS/Agent.OCJ trojan horse Elimina
C:\Documents and Settings\andre\Impostazioni locali\BraveSoftware\Brave-Browser\User Data\Default\Cache\f_00676d JS/Agent.OCJ trojan horse Elimina
C:\Documents and Settings\andre\Impostazioni locali\BraveSoftware\Brave-Browser\User Data\Default\Cache\f_00676e JS/Agent.OCJ trojan horse Elimina
C:\ProgramData\Microsoft\Windows\Containers\BaseImages\29d8b5d7-1735-4b27-9ca1-9ea12269b252\BaseLayer\Files\Documents and Settings\andre\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\f_00676d JS/Agent.OCJ trojan horse Elimina
C:\ProgramData\Microsoft\Windows\Containers\BaseImages\29d8b5d7-1735-4b27-9ca1-9ea12269b252\BaseLayer\Files\Documents and Settings\andre\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\f_00676e JS/Agent.OCJ trojan horse Elimina
C:\ProgramData\Microsoft\Windows\Containers\BaseImages\29d8b5d7-1735-4b27-9ca1-9ea12269b252\BaseLayer\Files\Documents and Settings\andre\Impostazioni locali\BraveSoftware\Brave-Browser\User Data\Default\Cache\f_00676d JS/Agent.OCJ trojan horse Elimina
C:\ProgramData\Microsoft\Windows\Containers\BaseImages\29d8b5d7-1735-4b27-9ca1-9ea12269b252\BaseLayer\Files\Documents and Settings\andre\Impostazioni locali\BraveSoftware\Brave-Browser\User Data\Default\Cache\f_00676e JS/Agent.OCJ trojan horse Elimina

View attachment 216668

Brave is not properly signed in Eset, you need to check the ssl settings in Eset.
Thats mostly the problem with rather new browsers.

Check advanced settings - Web and email :

 

[Divine_Barakah]

So guys should these malicious scripts, if I may say, be taken seriously? I mean would you enter your login credentials and proceed with log in?

 

[L0ckJaw]

So guys should these malicious scripts, if I may say, be taken seriously? I mean would you enter your login credentials and proceed with log in?

Nope because Eset wont even allow me to visit the site.

 

[Divine_Barakah]

Blocking scripts in Brave breaks the site

 

[Divine_Barakah]

I have reported the issue to CashU support and provided them with Kaspersky's report and a link to this forum post. Thank you all for your help.