Friday, March 29, 2024

Lucifer – New Self-Propagating Malware Exploit Multiple Critical Bugs to Infect Windows Devices

Recently, the security experts have discovered a new self-propagating cryptojacking and DDoS-based malware “Lucifer” that are exploiting critical vulnerability to infect Windows devices. 

This vulnerability was discovered on May 29,2020, after investigating the vulnerability, the experts named it Lucifer, and this malware is capable in conducting DDoS attacks, and it is very well known for all kinds of exploits against different vulnerable Windows devices.

According to the Report from Palo Alto Networks, the main motive of the vulnerability was to infect the computer by attacking them with critical exploits, as they are aiming to take advantage of an “exhaustive” record of unpatched vulnerabilities.

But, there are patches accesible for all the significant and high-severity bugs, but several firms got struck by the malware and not even applied for the fixes yet.

Lucifer: Cryptojacking and DDoS Campaign

Initially, the author of this malware has decided to name this malware as Satan DDoS, although there is already a malware that has a similar name as “Satan ransomware.” Therefore, the author, after having discussed with his team, decided to keep the name “Lucifer.” 

After deciding the name, the experts recognized two versions of Lucifer during the research. However, at first, they focused on version 1, and then they highlighted the changes and corrected them on version 2 in the next part.

Well, the malware “Lucifer” comprises a total of three sections, and all the three sections contain a binary for a special purpose.

The x86 support section includes a UPX-packed x86 version of XMRig 5.5.0, whereas the x64 resource section includes a UPX-packed x64 version of XMRig 5.5.0.

The last, the SMB section includes a binary, that contains a lot of equation groups such as EternalBlue and EternalRomance, and the vile DoublePulsar backdoor implant.

Lucifer: Version 2

Well, if we talk about the version 2 of “Lucifer,” then it is quite comparable to its forerunner. As its overall abilities and behaviors are very similar to the original one, and more importantly, it separates XMRig for cryptojacking, not only this, but it also manages C2 operation and develops itself by exploitation and brute-forcing vulnerability. 

Both the version shares a lot of similarities, but version 2 has some amazing differences, that makes is better than the version 1.

The experts also opined that the malware is growing in sophistication; that’s why they warn the users and ask them to be careful.

Moreover, the enterprises could defend themselves with simple security actions like implementing patches and changing and putting some strong passwords.

  • HFS found in the HTTP response: CVE-2014-6287
  • Jetty found in the HTTP response: CVE-2018-1000861
  • Servlet found in the HTTP response: CVE-2017-10271

No keywords found in the HTTP response:-

All these malware are quite dangerous, and experts have strongly recommended all the organizations to keep their system up-to-date, remove all weak credentials, and have a layer of protection so that it will help in an emergency situation.

You can find the complete Indicators of compromise.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Website

Latest articles

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles