Friday, June 14, 2024

Lucifer – New Self-Propagating Malware Exploit Multiple Critical Bugs to Infect Windows Devices

Recently, the security experts have discovered a new self-propagating cryptojacking and DDoS-based malware “Lucifer” that are exploiting critical vulnerability to infect Windows devices. 

This vulnerability was discovered on May 29,2020, after investigating the vulnerability, the experts named it Lucifer, and this malware is capable in conducting DDoS attacks, and it is very well known for all kinds of exploits against different vulnerable Windows devices.

According to the Report from Palo Alto Networks, the main motive of the vulnerability was to infect the computer by attacking them with critical exploits, as they are aiming to take advantage of an “exhaustive” record of unpatched vulnerabilities.

But, there are patches accesible for all the significant and high-severity bugs, but several firms got struck by the malware and not even applied for the fixes yet.

Lucifer: Cryptojacking and DDoS Campaign

Initially, the author of this malware has decided to name this malware as Satan DDoS, although there is already a malware that has a similar name as “Satan ransomware.” Therefore, the author, after having discussed with his team, decided to keep the name “Lucifer.” 

After deciding the name, the experts recognized two versions of Lucifer during the research. However, at first, they focused on version 1, and then they highlighted the changes and corrected them on version 2 in the next part.

Well, the malware “Lucifer” comprises a total of three sections, and all the three sections contain a binary for a special purpose.

The x86 support section includes a UPX-packed x86 version of XMRig 5.5.0, whereas the x64 resource section includes a UPX-packed x64 version of XMRig 5.5.0.

The last, the SMB section includes a binary, that contains a lot of equation groups such as EternalBlue and EternalRomance, and the vile DoublePulsar backdoor implant.

Lucifer: Version 2

Well, if we talk about the version 2 of “Lucifer,” then it is quite comparable to its forerunner. As its overall abilities and behaviors are very similar to the original one, and more importantly, it separates XMRig for cryptojacking, not only this, but it also manages C2 operation and develops itself by exploitation and brute-forcing vulnerability. 

Both the version shares a lot of similarities, but version 2 has some amazing differences, that makes is better than the version 1.

The experts also opined that the malware is growing in sophistication; that’s why they warn the users and ask them to be careful.

Moreover, the enterprises could defend themselves with simple security actions like implementing patches and changing and putting some strong passwords.

  • HFS found in the HTTP response: CVE-2014-6287
  • Jetty found in the HTTP response: CVE-2018-1000861
  • Servlet found in the HTTP response: CVE-2017-10271

No keywords found in the HTTP response:-

All these malware are quite dangerous, and experts have strongly recommended all the organizations to keep their system up-to-date, remove all weak credentials, and have a layer of protection so that it will help in an emergency situation.

You can find the complete Indicators of compromise.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.


Latest articles

Sleepy Pickle Exploit Let Attackers Exploit ML Models And Attack End-Users

Hackers are targeting, attacking, and exploiting ML models. They want to hack into these...

SolarWinds Serv-U Vulnerability Let Attackers Access sensitive files

SolarWinds released a security advisory for addressing a Directory Traversal vulnerability which allows a...

Smishing Triad Hackers Attacking Online Banking, E-Commerce AND Payment Systems Customers

Hackers often attack online banking platforms, e-commerce portals, and payment systems for illicit purposes.Resecurity...

Threat Actor Claiming Leak Of 5 Million Ecuador’s Citizen Database

A threat actor has claimed responsibility for leaking the personal data of 5 million...

Ascension Hack Caused By an Employee Who Downloaded a Malicious File

Ascension, a leading healthcare provider, has made significant strides in its investigation and recovery...

AWS Announced Malware Detection Tool For S3 Buckets

Amazon Web Services (AWS) has announced the general availability of Amazon GuardDuty Malware Protection...

Hackers Exploiting MS Office Editor Vulnerability to Deploy Keylogger

Researchers have identified a sophisticated cyberattack orchestrated by the notorious Kimsuky threat group.The...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles