The malware mainly attacks users from the USA, Brazil, Pakistan, China, Mexico and Chile. During four months of activity, the botnet operators “earned” about $5,000, that is, an average of about $1,250 per month.

Do you know who else is focused on mining Monero and manipulates a variety of exploits? Lucifer! (don’t be alarmed – this is such malware)

“The malware uses several techniques for distribution, including LOLbins (living off the land) to use legitimate Windows processes to execute malicious code (including PsExec and WMI), SMB exploits (including EternalBlue), and stolen credentials”, – write Cisco Talos experts.

In total, the researchers counted more than 15 ingredients in Prometei. All of them are controlled by the main module, which encrypts (RC4) the data before sending it to the management server via HTTP.

Auxiliary modules can be used to establish communication over Tor or I2P, collect system information, check open ports, spread via SMB, and scan the infected system for any cryptocurrency wallets.

For example, a botnet steals passwords using a modified version of Mimikatz (miwalk.exe), and then passwords are passed to the spreader module (rdpclip.exe) for analysis and authentication via SMB. If that doesn’t work, the EternalBlue exploit is used for propagation.

The final payload delivered to the compromised system is SearchIndexer.exe, which is simply an XMRig version 5.5.3.

However, experts write that Prometei is not just a miner, the malware can also be used as a full-fledged Trojan and info-stealer.

“The botnet is split into two main branches: the C ++ branch is dedicated to cryptocurrency mining operations, and the .NET-based branch focuses on credential theft, SMB attacks and obfuscation. At the same time, the main branch can work independently from the second one, since it can independently communicate with the control server, steal credentials and engage in mining”, – say the researchers.

Cisco Talos experts point out that Prometei is unlike most mining botnets. Its authors not only divided their tools according to their purpose, it also “taught” malware to avoid detection and analysis. In particular, even in earlier versions, you can find several layers of obfuscation, which have become much more difficult in later versions.

The post Prometei botnet uses SMB for distribution appeared first on Gridinsoft Blog.

The Lucifer botnet attracted the attention of researchers after numerous incidents involving the exploitation of the critical vulnerability CVE-2019-9081 in the Laravel framework, which could lead to remote execution of arbitrary code.

Version of the malware that uses CVE-2019-9081, was spotted on May 29, 2020, after which the campaign stopped on June 10 and resumed after a few days, but with an updated version of the malware.

“If initially it was believed that the malware was quite simple and designed for mining cryptocurrency (Monero), it has now become clear that Lucifer also has a DDoS component and self-distribution mechanism, built on a number of serious vulnerabilities and brute force”, – say the experts.

For distribution on the network, Lucifer uses such well-known exploits as EternalBlue, EternalRomance and DoublePulsar, stolen from special services and in 2017 published in the public domain by The Shadow Brokers. But the attackers are not limited only to this bug, so the list of exploits taken by Lucifer into service is as follows:

• CVE-2014-6287
• CVE-2018-1000861
• CVE-2017-10271
• CVE-2018-20062 (RCE-vulnerability in ThinkPHP)
• CVE-2018-7600
• CVE-2017-9791
• CVE-2019-9081
• RCE-backdoor in PHPStudy
• CVE-2017-0144
• CVE-2017-0145
• CVE-2017-8464

It is worth noting that all these vulnerabilities have already been fixed, and patches are available for them.

“After using exploits, an attacker can execute arbitrary commands on a vulnerable device. Considering that the attackers use the certutil utility in the payload to distribute the malware, in this case, the targets are both Windows hosts on the Internet and on the intranet”, — write the researchers.

Lucifer is also able to scan machines with open TCP 135 (RPC) and 1433 (MSSQL) ports and check if certain combinations of usernames and passwords are suitable for them. For brute force attacks, the malware uses a dictionary with 300 passwords and seven user names: sa, SA, su, kisadmin, SQLDebugger, mssql and Chred1433.

“The malware is able to infect devices using IPC, WMI, SMB and FTP, using brute force, as well as using MSSQL, RPC and network sharing”,- say the researchers.

Having infected the system, Lucifer places its copy there using the shell command, and also installs XMRig for secret mining of the Monero cryptocurrency (XMR). Judging by the fact that criminals currently earned only 0.493527 XMR (about $30 at the current exchange rate), experts believe that the malicious campaign is just beginning.

Also, gaining a foothold in the system, Lucifer connects to the management server to receive commands, for example, to launch a DDoS attack, transfer stolen system data or inform its operators about the state of the miner.

A newer version of malware also comes with analysis protection and checks the username and the infected machine before attacking. If Lucifer discovers that it is running in an analytical environment, it ceases all activity.

Recall also that according to the observations of information security experts, Evil Corp returns to criminal activity with WastedLocker ransomware.

The post Lucifer malware uses many exploits, is engaged in mining and DDoS attacks appeared first on Gridinsoft Blog.