Saturday, December 9, 2023

Lu0Bot Node.js Malware Takes Complete Control Over Victim’s Computer

Through strategies like polymorphic code, which continuously alters its appearance to prevent detection, as well as employing encryption and obfuscation to disguise its actions, malware is getting more complex and sneaky.

Additionally, to infiltrate systems and avoid detection by traditional security measures, malware increasingly leverages social engineering and advanced delivery methods, like- 

  • Spear-phishing
  • Zero-day exploits

Recently, cybersecurity researchers at Any.Run has examined a Node.js-based Lu0Bot malware sample that completely takes over the victim’s computer system.

Researchers were intrigued by Node.js malware, initially thought to be a basic DDOS bot but revealed as more complex. Node.js targets a versatile runtime environment used in modern web apps.

Document
FREE Demo

Deploy Advanced AI-Powered Email Security Solution

Implementing AI-Powered Email security solutions “Trustifi” can secure your business from today’s most dangerous email threats, such as Email Tracking, Blocking, Modifying, Phishing, Account Take Over, Business Email Compromise, Malware & Ransomware

Lu0Bot Malware

Since this malware utilizing JavaScript employs multi-layer obfuscation techniques, that’s why it poses a distinctive detection challenge.

Lu0bot emerged in February 2021 as a GCleaner second-stage payload, functioning as a bot that awaits commands from a C2 server and sends encrypted system data.

The bot’s activity is modest, with 5-8 new monthly samples on dark marketplaces. 

As of now, only one new sample was uploaded in August, but there may be more dormant ones awaiting C2 commands, though this is speculative.

Despite limited activity, Lu0bot’s creative Node.js design sets it apart, with its capabilities bounded only by the language itself.

Due to the bot’s IP address issue, the security analysts were unable to find a live sample. However, a public sample connected, triggering:-

  • JavaScript
  • A new domain
  • Encrypted exchanges

Researchers quickly detected an SFX packer in the file, which acts as a self-extracting archive that is openable with any utility.

SFX-packer (Source – Any.Run)

While besides this, the archive contains a BAT file and more:-

  • BAT-file
  • Files eqnyiodbs.dat 
  • lknidtnqmg.dat file 
  • gyvdcniwvlu.dat file

The static analysis highlights the following things:-

  • EXE file
  • lknidtnqmg.dat

This malware stands out in how it constructs its domain, assembling it from parts in the JS code.

dns request
DNS requests (Source – Any.Run)

Security researchers received a JavaScript code that’s deeply obfuscated and unreadable.

unreadable code
Unreadable code (Source – Any.Run)

Researchers confirmed code readability after removing excess bytes and applying a JavaScript deobfuscator, resulting in this transformation:

transformed code
Transformed code (Source – Any.Run)

The code begins with an encrypted string array which:-

  • Undergoes manipulation
  • Decrypts using BASE64
  • URL encoding
  • RC4 with two variables

Capabilities of Lu0Bot

Here below, we have mentioned all the capabilities of Lu0Bot malware:-

  • Recording keystrokes 
  • Identity theft 
  • Gaining full control of the victim’s computer 
  • Functioning as a DDOS bot 
  • Using the compromised system for performing illegal activities

If Lu0bot’s campaign scales and the server becomes active, its distinctive use of NODE JS makes it an intriguing analysis subject with potential risks.

Protect yourself from vulnerabilities using Patch Manager Plus to quickly patch over 850 third-party applications. Take advantage of the free trial to ensure 100% security.

Website

Latest articles

WordPress POP Chain Flaw Exposes Over 800M+ Websites to Attack

A critical remote code execution vulnerability has been patched as part of the Wordpress...

Russian Star Blizzard New Evasion Techniques to Hijack Email Accounts

Hackers target email accounts because they contain valuable personal and financial information. Successful email...

Exploitation Methods Used by PlugX Malware Revealed by Splunk Research

PlugX malware is sophisticated in evasion, as it uses the following techniques to avoid...

TA422 Hackers Attack Organizations Using Outlook & WinRAR Vulnerabilities

Hackers exploit Outlook and WinRAR vulnerabilities because these widely used software programs are lucrative...

Bluetooth keystroke-injection Flaw: A Threat to Apple, Linux & Android Devices

An unauthenticated Bluetooth keystroke-injection vulnerability that affects Android, macOS, and iOS devices has been...

Atlassian Patches RCE Flaw that Affected Multiple Products

Atlassian has been discovered with four new vulnerabilities associated with Remote Code Execution in...

Reflectiz Introduces AI-powered Insights on Top of Its Smart Alerting System

Reflectiz, a cybersecurity company specializing in continuous web threat management, proudly introduces a new...
Tushar Subhra Dutta
Tushar Subhra Dutta
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Endpoint Strategies for 2024 and beyond

Converge and Defend

What's the pulse of Unified Endpoint Management and Security (UEMS) in Europe? Join us live to uncover the strategies that are defining endpoint security in the region.

Related Articles