Palo Alto Networks Experts prepared a report about Malvari Lucifer, which uses many exploits and, according to experts, "wreaks havoc" on Windows hosts. It is noted that the authors of the malware themselves gave their brainchild the name Satan DDoS, but information security experts call it Lucifer to distinguish the Satan cryptographer.
The Lucifer botnet attracted the attention of researchers after numerous incidents involving the exploitation of the critical vulnerability CVE-2019-9081 in the Laravel framework, which could lead to remote execution of arbitrary code.
The Malvari version using CVE-2019-9081 was spotted on May 29, 2020, after which the campaign stopped on June 10 and resumed after a few days, but with an updated version of the malware.
If initially it was believed that the malware was simple enough and intended for mining cryptocurrency (Monero), now it has become clear that Lucifer also has a DDoS component and self-distribution mechanism, built on the use of a number of serious vulnerabilities and brute force.
For distribution on the network, Lucifer uses such well-known exploits as EternalBlue, EternalRomance and DoublePulsar, stolen from the special services and in 2017 published in the public domain by the group The Shadow Brokers. But the attackers are not limited to this alone, so the list of exploits taken by Lucifer into service is as follows:
It is worth noting that all of these vulnerabilities have already been fixed, and patches are available for them.
“After using exploits, an attacker can execute arbitrary commands on a vulnerable device. Given that attackers use the payload utility certutil for the distribution of malvari, in this case, the goals are both Windows hosts on the Internet and on the intranet, ”the researchers write.
Lucifer is also able to scan machines with open TCP 135 (RPC) and 1433 (MSSQL) ports and check if certain combinations of usernames and passwords are suitable for them. For brute force attacks, the malware uses a dictionary with 300 passwords and a total of seven user names: sa, SA, su, kisadmin, SQLDebugger, mssql and Chred1433.
Researchers claim that malware can infect devices using IPC, WMI, SMB and FTP, using brute force, as well as using MSSQL, RPC and network sharing.
Having penetrated the system, Lucifer places its copy there using the shell command, and also installs XMRig for secret mining of the Monero cryptocurrency (XMR). Judging by the fact that only 0.493527 XMR (about $ 30 at the current exchange rate) can be found on the purses of criminals, experts believe that the malicious campaign is just beginning.
Also, gaining a foothold in the system, Lucifer connects to the management server to receive commands, for example, to launch a DDoS attack, transfer stolen system data or inform its operators about the state of the miner.
A newer version of Malvari also comes with analysis protection and checks the username and the infected machine before attacking. If Lucifer discovers that it is running in an analytical environment, it ceases all activity.