Self-Propagating Lucifer Malware Targets Windows Systems

guest · Jun 24, 2020

Self-Propagating Lucifer Malware Targets Windows Systems
A new devilish malware is targeting Windows systems with cryptojacking and DDoS capabilities
June 24, 2020
https://threatpost.com/self-propagating-lucifer-malware-targets-windows-systems/156883/

Security experts have identified a self-propagating malware, dubbed Lucifer, that targets Windows systems with cryptojacking and distributed denial-of-service (DDoS) attacks.

The never-before-seen malware initially tries to infect PCs by bombarding them with exploits in hopes of taking advantage of an “exhaustive” list of unpatched vulnerabilities. While patches for all the critical and high-severity bugs exist, the various companies impacted by the malware had not applied the fixes.

“Lucifer is a new hybrid of cryptojacking and DDoS malware variant that leverages old vulnerabilities to spread and perform malicious activities on Windows platforms,” said researchers with Palo Alto Networks’ Unit 42 team, on Wednesday in a blog post. “Applying the updates and patches to the affected software are strongly advised.”
Click to expand...

The malware is also capable of self-propagation through various methods.

It scans for either open TCP ports (also known as port 1433) or open Remote Procedure Call (RPC) ports (also known as port 135). If either of these port is open, the malware attempts to brute-force the login using a default administrator username and an embedded password list (a full list of the passwords used can be found on Unit 42’s analysis).

In addition to brute-forcing credentials, the malware leverages exploitation for self-propagation. If the Server Message Block (SMB) protocol (a network file sharing protocol) is open, Lucifer executes several backdoors. These include the EternalBlue, EternalRomance, and DoublePulsar exploits.
Click to expand...

Palo Alto Networks - Unit42: Lucifer: New Cryptojacking and DDoS Hybrid Malware Exploiting High and Critical Vulnerabilities to Infect Windows Devices

A closer look revealed the malware, which we’ve dubbed “Lucifer”, is capable of conducting DDoS attacks and well-equipped with all kinds of exploits against vulnerable Windows hosts.
Lucifer is quite powerful in its capabilities.

Lucifer is a new hybrid of cryptojacking and DDoS malware variant that leverages old vulnerabilities to spread and perform malicious activities on Windows platforms.
Click to expand...

guest · Aug 19, 2020

Lucifer cryptomining DDoS malware now targets Linux systems
August 19, 2020
https://www.bleepingcomputer.com/ne...ining-ddos-malware-now-targets-linux-systems/

A hybrid DDoS botnet known for turning vulnerable Windows devices into Monero cryptomining bots is now also scanning for and infecting Linux systems.
While the botnet's authors named it Satan DDoS, security researchers are calling it Lucifer to differentiate it from Satan ransomware.

Besides adding Linux targeting support, Lucifer's creators have also expanded the Windows version's capabilities to steal credentials and escalate privileges using the Mimikatz post-exploitation tool.
Similar capabilities to the Windows version
As detailed in a report published today by researchers at NETSCOUT's ATLAS Security Engineering & Response Team (ASERT), the Linux port displays the same welcome message as the Windows variant.
The new Linux version comes with capabilities similar to the Windows counterpart, including modules designed for cryptojacking and for launching TCP, UCP, and ICMP-based flooding attacks.
Click to expand...

"The fact that it can run on Linux-based systems means that it can potentially compromise and make use of high-performance, high-bandwidth servers in internet data centers (IDCs), with each node packing a larger punch in terms of DDoS attack capacity than is typical of most bots running on Windows or IoT-based Linux devices," the NETSCOUT researchers explained.
Click to expand...

Netscout: Lucifer’s Spawn

Lucifer, a cryptojacking and distributed denial of service (DDoS) bot, originally found to exploit and run on Windows based systems and first reported by Palo Alto Networks’ Unit42 on June 24, 2020, now includes additional tools and a port to the Linux operating system. ASERT researchers uncovered new PE sources, which included the popular credential stealing tool MIMIKATZ, further increasing Lucifer’s ability to infect systems and increase its footprint.
Click to expand...

Log in or Sign up

Self-Propagating Lucifer Malware Targets Windows Systems

guest Guest

guest Guest

Log in or Sign up

Self-Propagating Lucifer Malware Targets Windows Systems

guest Guest

guest Guest

Useful Searches