Rewterz Threat Alert – Lucifer New Cryptojacking and DDoS Hybrid Malware

June 25, 2020

Severity

High

Analysis Summary

Lucifer, capable of conducting DDoS attacks and well-equipped with all kinds of exploits against vulnerable Windows hosts is actively targeting Windows systems with cryptojacking and DDoS capabilities. Researchers have identified a self-propagating malware, dubbed Lucifer, that targets Windows systems with cryptojacking and distributed denial-of-service (DDoS) attacks. Lucifer targets PCs by bombarding them with exploits in hopes of taking advantage of an “exhaustive” list of unpatched vulnerabilities.

The vulnerabilities targeted by Lucifer include Rejetto HTTP File Server (CVE-2014-6287), Oracle Weblogic (CVE-2017-10271), ThinkPHP RCE (CVE-2018-20062), Apache Struts (CVE-2017-9791), Laravel framework CVE-2019-9081), and Microsoft Windows (CVE-2017-0144, CVE-2017-0145, and CVE-2017-8464).

Lucifer is not only capable of dropping XMRig for cryptojacking Monero, it’s also capable of command and control (C2) operation and self-propagation through the exploitation of multiple vulnerabilities and credential brute-forcing after scanning of open TCP ports (also known as port 1433) or open Remote Procedure Call (RPC) ports (also known as port 135). Additionally, it drops and runs EternalBlue, EternalRomance, and DoublePulsar backdoor against vulnerable targets for intranet infections.

Impact

DDoS
Cryptojacking
Execution of arbitrary commands

Indicators of Compromise

MD5

09836461312a3781af6e1298c6b2c249
2f0a52ce4f445c6e656ecebbcaceade5
900c175024c7aa58aab0c62897e2471a
fb82ba8bb7a402b05d06436991b10321
3e5d06dc6e7890e1800cf24c9f599856
c7fad963ad8e46e773dc5ee9177ab218
30017e300c6d92e126bf92017c195c37
e4ad4df4e41240587b4fe8bbcb32db15
9a5cec05e9c158cbc51cdc972693363d
d1aae806243cc0bedb83a22919a3a660
6b7276e4aa7a1e50735d2f6923b40de4
838ceb02081ac27de43da56bec20fc76
756b6353239874d64291e399584ac9e5
a05c7011ab464e6c353a057973f5a06e
4ff94c163565a38a27cf997ad07b3d69
8b0a4ce79f5ecdb17ad168e35db0d0f9
6fe4544d00b77e0295e779e82d8f0fe5
f0881d5a7f75389deba3eff3f4df09ac
43aac72a9602ef53c5769f04e1be7386
e53f9e6f1916103aab8703160ad130c0
83076104ae977d850d1e015704e5730a
497080fed2000e8b49ee2e97e54036b1
b777086fd83d0bc1dccdc7c126b207d0
4803a7863da607333378b773b6a17f4c
dc646bdbe28b453ba190a6356959d028
1ca9e6eb86036daea4dfa3297f70d542
1fa609bc0d252ca0915d6aed2df7ccc2
00dd6b018c3c2d347df43f779715bca5
ba629216db6cf7c0c720054b0c9a13f3
c24315b0585b852110977dacafe6c8c1
23d84a7ed2e8e76d0a13197b74913654
770d0caa24d964ea7c04ff5daf290f08
5e8ecdc3e70e2ecb0893cbda2c18906f
1f0669f13dc0545917e8397063f806db
a539d27f33ef16e52430d3d2e92e9d5c
4420f8917dc320a78d2ef14136032f69
46f7b320b13a4b618946042360215179
01d5adbfee39c5807ee46f7990f5fda7
5b72ccfa122e403919a613785779af49
0647dcd31c77d1ee6f8fac285104771a
47106682e18b0c53881252061ffcaa2d
8969668746ae64ca002cc7289cd1c5da
649b368c52de83e52474a20ce4f83425
09d45ae26830115fd8d9cdc2aa640ca5
31d696f93ec84e635c4560034340e171
f82fa69bfe0522163eb0cf8365497da2
5adcbe8bbba0f6e733550ce8a9762fa0
f01f09fe90d0f810c44dce4e94785227
24aa99837d14bee5da2e2339b07f9d4c
d9b5b26f0423230e99768092f17919a3
90d179a2f46c02bcdf9cf625ea5aa752
9744f0000284c2807de0651c7e0d980a
ee2d6e1d976a3a92fb1c2524278922ae
89b7dac7d9ce5b75b08f5d037edd3869

SHA-256

24437f92578b3632452e1e9a97341c781d36dae544d4d6827e5831c71e0f34db
5def9f81ea8187a2716c77fe21a709b9c760762973fc3bbe62203e2b5897f1cc
3c9b80de476f842c4325580ab628ddebae4a7261ffaee52c3df0514a368d3c11
5c75ac1a0f824cb3b14a84b5b2dba0a52ed150e2e410850eafa08338dd596198
ab0c0471fd57e3ed03bbb5c5e4564c3843d62d0b7b88a15a18cd2d057a22a9f6
ab9e4c3c4827896a309a16b289e97ae848113590c8db2a62b931833ab83d9099
04d17a702b485ae343287239b0b6201ebcaea3dd24188579800d21a16f9b35c6
d690b048e3984f9f8305ba0d3fb4eeea490a1461796b6927a31d0beffdafbc8b
5e8bfc88a5643c40d6efd4462cd918573e9be6fd934222a0bccc64d3e789fdfc
64af944e3ca7dec9a5673df3043d24064351de33a6ecc61ad2d288956a570bff
3a3344f89ce8c459c11b7d480db274e8ea438cacedfe60332b1b2b65e82dfab1
8995c73fe107b3c4dad829db8e7a6b9b2bee29811d73909a9bf67ad5bd5acacb
7a08530d46fd2bd0e61cb5ebeae8a32b6020cda5555290d5e7d8b2838127d0f6
74254df16012b0ffee18f02c96820e507b961cc6a7bcb5cc2a5f43064291d0a4
4a928ff8904640733cff08bd5f70e23ee2466cb8f925a1764e9ad61bbf006efd
8b4b3f131d70922502e61e7ef294f69916d289f72fe3dcccca7e2ebb904de018
ab8511ed01a0601e974809c8f3f92094ebf6669679228ce6daea6027ab59e554
33c14ef70be64290bcd9bd5abc72f2e39f50bfa567c5f521ee5d3406deb80a93
5ae7d87b81db21da2b6212ff1229264093b5954f2d6ffb273420f898141c611d
02981319f54847a5587fc9cb4e32c54a76bdcfe583bc3059ee79a40c4a4409d7
2dfd7a838abcf46e420e418af04413ba53cc5592ec18b8a6fe35cab161baeb48
52da4c4c3ac7237ee803a5aa3250d9ca1b571876d46d725135079a866b4a554d
437064714d5b080673fbdeae792a5376fbd8be361a6783a8bda78d944975f055
18267b8425c9dbcf4de44b22c80712ac58ddff7e3fa54839252bd5337778859f
c735098987b555b3aa3adb58e0691d9280c2b593307072d7d731e02cd338d7ac
32d18553602309c19b5f88a1761bc1598f346124915c2c38e1129b7c5cf94a42
0be5db462b912cc4207e47c7fe0a80153e1f15a327a486fb2ba3e0c1efa2978a
686eb63c8b5c07040f22e6fee0cc76baabe283fcffc0926df1bf3b802aeb8cfe
57d1f4287e36c4b109afb797d50d693329d92e6d9ee69822242e55cac3c422f7
00f49b9f5e2d0156017dd5421c9301cf62b0a023d45f36455cf1d287c7f061cb
fc0997022f3b02556362ff87c59ba6db6751070aa7e73a42ac634af0eaab6ca5
d05609b368bc35d4795cc220ef42ea06d9ac8284e49b218c64789876ccdacb2e
42e1a05ab55d4a209d6198454718e6aaf0ac63b1778ccfc648b7791d06eddc44
7857ecefa14ab3d86a699700b313c85d6d3b106fe5375f5a5e938784271fb1dd
21167b8443213332b519140e364cf25043b2b9171ac8ab3ce4b591e62c3b5f89
b585e210997e38741c4842979472b38e704c187a11565e32d549d0aab181ad3a
b8a24d8aa9b936413be925091ff551a9e872c634e9aef28df0f19363645e1224
d29841ebebeb48fc3da7e23ce4a0a4d3e48c1602485e9fbe913cb2ff8eb9d0dd
39e8a25b0875e2ba1906b83b2d0c2cfd0762a5f1a670e6d736cc3873125b807c
45d943c1a4e3615a52f7561791c331cd7d996dd6ddc5421fab78c2d734fed6b6
b13cb42cb21efe404a88501e9ecca74f695b527a42934e62625ddf11fefcea9a
0a4d0fb773e9251bd420e3998605500881bca21119d7af44f06b002de2cdc8fe
5d181f72ca116b2925151416d5cc6d8f7ab29242be9030ec927e7175c764f56f
b64712d39bd2ce26bb24f6cd5877554bee39240bd5994a1a6143bba660c34e2b
782d840f3dc7f648f8404de3e4039882e05fcf8cd2cba1509136835f6cb547d0
fe9f693a81ceed943854896543406edd1a6e4c2ee6a84abf196659fc8617f22e
478021e127232f6c6bad31b342486c88d58ab299e6c1336bbf3da00f3c38f1c8
6791024c02a9045b237f9bf09e2ca7a7e3503d81a59f4691e5442670be21b0c1
f2d9d7703a5983ae3b7767c33ae79de1db093ea30f97d6b16bb5b62f03e99638
4365c2ba5505afeab2c479a9c546ed3cbc07ace184fe5019947823018feb4265
66d619ca5e848ce0e4bcb1252ff8a4f0a060197a94810de85873c76fa3826c1e
b6d4b4ef2880238dc8e322c7438f57b69cec6d44c0599875466a1edb8d093e15
84b0f2e4d222b0a2e34224e60b66340071e0d03c5f1a2af53b6005a3d739915f
4c729b343ed3186dffdf80a8e3adfea7c2d56a7a06081333030fb4635e09d540

SHA1

ea659a9385e8b208d06b052bf4eca5109b3bc423
e8c98dbcd20d45bbbbf4994cc4c95dfcf504c690
5b8606d26481bbbe805e495ebee6f24ebd4d8a73
ad0bf4949fd277a9af051e3e9c8b45364c19d443
be855cd1bfc1e1446a3390c693f29e2a3007c04e
aa1c85cf96362ce2db7d4c4b7e352498b0cd798b
75be54839f3d01dc4755ddc319f23f287b1f9a7b
deb93b49d66f309739a4b6328060a65fba15d33c
74de4831605f018367556c75e5bdf3040e186e8b
23d04ba674bafbad225243dc81ce7eccd744a35a
3db28aff71ee62967b2116e1924e7a976a17560a
4af3fae881a80355dd09df6e736203c30c4faac5
07246812541e132d4c82b1e6563df181e6e3763c
db8603ac6cac7eb3690f67af7b8d081aa9ce3075
036f327417b7e1c6e0b91831440992972bc7802e
41a6ad8d88b6999ac8a3ff00dd9641a37ee20933
ad23c33806a0d77ce9779f8560a8921f64964a95
9da0cdedf7cba2107ffba8d031d0aa4f58e6c194
c356f6f42f13e8e561dcf511adee3ae6264725e2
98c420fedb4afbe3c015833118a690e712d4ef79
35493e06b0b2cdab2211c0fc02286f45d5e2606d
0d7894b6381c127c49f3892a862eaf37393d0355
8e852929c56abbf2cf4903c3d6d95006801b9a6b
3eb0da5a71456c7c2459fa44611ff53cd1b36a15
8bd37b56569d25948c9d42d4f0c530532147a9b0
9d3eab54b8cc458c97d1c874661d3e942fc7598b
06cd886586835b2bf0d25fba4c898b69e362ba6d
a71bd1befaf64787eb2edb4e3d96ae74e249aef1
f560ea0a109772be2b62c539b0bb67c46279abd1
43f92d0e47b1371c0442c6cc8af3685c2119f82c
92a68b223b2d2e501c1f0123fabf63e15fff4d11
7cb553a8ea5715a0089d806e24824994c60a12ac
776e7079734bc4817e3af0049f42524404a55310
71340d05509c0e7376cd499606b0f1f65aa8d80f
1c9586c63d64b57ce690a04e50d10ea37671dd6a
37bb800b2bb812d4430e2510f14b5b717099abaa

Remediation

Block all threat indicators at your respective controls.
Search for IOCs in your environment.
Apply patches and updates to the affected software.