Lucifer – New Self-Propagating Malware Exploit Multiple Critical Bugs to Infect Windows Devices

Recently, the security experts have discovered a new self-propagating cryptojacking and DDoS-based malware “Lucifer” that are exploiting critical vulnerability to infect Windows devices. 

This vulnerability was discovered on May 29,2020, after investigating the vulnerability, the experts named it Lucifer, and this malware is capable in conducting DDoS attacks, and it is very well known for all kinds of exploits against different vulnerable Windows devices.

According to the Report from Palo Alto Networks, the main motive of the vulnerability was to infect the computer by attacking them with critical exploits, as they are aiming to take advantage of an “exhaustive” record of unpatched vulnerabilities.

But, there are patches accesible for all the significant and high-severity bugs, but several firms got struck by the malware and not even applied for the fixes yet.

Lucifer: Cryptojacking and DDoS Campaign

Initially, the author of this malware has decided to name this malware as Satan DDoS, although there is already a malware that has a similar name as “Satan ransomware.” Therefore, the author, after having discussed with his team, decided to keep the name “Lucifer.” 

After deciding the name, the experts recognized two versions of Lucifer during the research. However, at first, they focused on version 1, and then they highlighted the changes and corrected them on version 2 in the next part.

Well, the malware “Lucifer” comprises a total of three sections, and all the three sections contain a binary for a special purpose.

The x86 support section includes a UPX-packed x86 version of XMRig 5.5.0, whereas the x64 resource section includes a UPX-packed x64 version of XMRig 5.5.0.

The last, the SMB section includes a binary, that contains a lot of equation groups such as EternalBlue and EternalRomance, and the vile DoublePulsar backdoor implant.

Lucifer: Version 2

Well, if we talk about the version 2 of “Lucifer,” then it is quite comparable to its forerunner. As its overall abilities and behaviors are very similar to the original one, and more importantly, it separates XMRig for cryptojacking, not only this, but it also manages C2 operation and develops itself by exploitation and brute-forcing vulnerability. 

Both the version shares a lot of similarities, but version 2 has some amazing differences, that makes is better than the version 1.

The experts also opined that the malware is growing in sophistication; that’s why they warn the users and ask them to be careful.

Moreover, the enterprises could defend themselves with simple security actions like implementing patches and changing and putting some strong passwords.

• HFS found in the HTTP response: CVE-2014-6287
• Jetty found in the HTTP response: CVE-2018-1000861
• Servlet found in the HTTP response: CVE-2017-10271

No keywords found in the HTTP response:-

• ThinkPHP remote code execution (RCE) vulnerabilities
• CVE-2018-7600
• CVE-2017-9791
• CVE-2019-9081
• PHPStudy Backdoor remote code execution (RCE)

All these malware are quite dangerous, and experts have strongly recommended all the organizations to keep their system up-to-date, remove all weak credentials, and have a layer of protection so that it will help in an emergency situation.

You can find the complete Indicators of compromise.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.