Experts from Cisco Talos have recently observed a new Necro Python bot campaign and noticed that its developers have improved its capabilities.
Researchers noticed that malware authors have added multiple exploits for over 10 different web applications and the SMB protocol. The malicious code includes exploits for vulnerabilities in VMWare vSphere, SCO OpenServer, and the Vesta Control Panel.
The attack chain starts with the exploitation of one of the flaws in the targeted applications or the operating systems. In some cases, experts noticed that attackers used a Java-based downloader for the initial infection stage. The malware could infect bot Linux-based and Windows operating systems, The malware leverages a combination of a standalone Python interpreter and a malicious script, an also ELF executables created with pyinstaller.
Talos experts noticed that a version released on May 18 included Python versions of EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0147) exploits with a Windows download command line as the payload.
In the newest samples discovered on May 22, the bot improved its ability to supply credentials for SMB but the new features are not included the main exploit function.
“The usernames and passwords are now in a separate two arrays and extended to include many other usernames and passwords. The exploitation function of this sample does not contain EternalBlue and EternalRomance but attempts to connect over SMB (port 445) and create a service remotely to download and run the main bot file.” reads the analysis published by Talos.
Once compromised a system, the Necro Python bot will connect to a command-and-control (C2) server, it supports multiple commands, including the ability to exfiltrate data or to drop additional payloads.
The main payloads allow the malware to launch DDoS attacks, sniff and exfiltre network traffic using a SOCKS proxy and install XMRig Monero cryptocurrency mining software.
The bot used a user-mode rootkit to hide the malicious process and malicious registry entries created.
The latest versions also implement polymorphic abilities, like other IoT botnets, the malware targets small and home office (SOHO) routers.
“Necro Python bot shows an actor that follows the latest development in remote command execution exploits on various web applications and includes the new exploits into the bot,” concludes the report. “This increases its chances of spreading and infecting systems. Users need to make sure to regularly apply the latest security updates to all of the applications, not just operating systems.”
(SecurityAffairs – hacking, Necro Python bot)