Thursday, March 28, 2024

Lucifer – New Self-Propagating Malware Exploit Multiple Critical Bugs to Infect Windows Devices

Recently, the security experts have discovered a new self-propagating cryptojacking and DDoS-based malware “Lucifer” that are exploiting critical vulnerability to infect Windows devices. 

This vulnerability was discovered on May 29,2020, after investigating the vulnerability, the experts named it Lucifer, and this malware is capable in conducting DDoS attacks, and it is very well known for all kinds of exploits against different vulnerable Windows devices.

According to the Report from Palo Alto Networks, the main motive of the vulnerability was to infect the computer by attacking them with critical exploits, as they are aiming to take advantage of an “exhaustive” record of unpatched vulnerabilities.

But, there are patches accesible for all the significant and high-severity bugs, but several firms got struck by the malware and not even applied for the fixes yet.

Lucifer: Cryptojacking and DDoS Campaign

Initially, the author of this malware has decided to name this malware as Satan DDoS, although there is already a malware that has a similar name as “Satan ransomware.” Therefore, the author, after having discussed with his team, decided to keep the name “Lucifer.” 

After deciding the name, the experts recognized two versions of Lucifer during the research. However, at first, they focused on version 1, and then they highlighted the changes and corrected them on version 2 in the next part.

Well, the malware “Lucifer” comprises a total of three sections, and all the three sections contain a binary for a special purpose.

The x86 support section includes a UPX-packed x86 version of XMRig 5.5.0, whereas the x64 resource section includes a UPX-packed x64 version of XMRig 5.5.0.

The last, the SMB section includes a binary, that contains a lot of equation groups such as EternalBlue and EternalRomance, and the vile DoublePulsar backdoor implant.

Lucifer: Version 2

Well, if we talk about the version 2 of “Lucifer,” then it is quite comparable to its forerunner. As its overall abilities and behaviors are very similar to the original one, and more importantly, it separates XMRig for cryptojacking, not only this, but it also manages C2 operation and develops itself by exploitation and brute-forcing vulnerability. 

Both the version shares a lot of similarities, but version 2 has some amazing differences, that makes is better than the version 1.

The experts also opined that the malware is growing in sophistication; that’s why they warn the users and ask them to be careful.

Moreover, the enterprises could defend themselves with simple security actions like implementing patches and changing and putting some strong passwords.

  • HFS found in the HTTP response: CVE-2014-6287
  • Jetty found in the HTTP response: CVE-2018-1000861
  • Servlet found in the HTTP response: CVE-2017-10271

No keywords found in the HTTP response:-

All these malware are quite dangerous, and experts have strongly recommended all the organizations to keep their system up-to-date, remove all weak credentials, and have a layer of protection so that it will help in an emergency situation.

You can find the complete Indicators of compromise.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Website

Latest articles

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Beware of Free Android VPN Apps that Turn Your Device into Proxies

Cybersecurity experts have uncovered a cluster of Android VPN applications that covertly transform user...

ZENHAMMER – First Rowhammer Attack Impacting Zen-based AMD Platforms

Despite AMD's growing market share with Zen CPUs, Rowhammer attacks were absent due to...

Airbus to Acquire INFODAS to Strengthen its Cybersecurity Portfolio

Airbus Defence and Space plans to acquire INFODAS, a leading cybersecurity and IT solutions...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles