Necro Freakout Malware
Share this:
New upgrades have been made to a Python-based “self-replicating, polymorphic bot” called Necro with improving technique to evade detection spreading Vulnerabilities in VMware vSphere , SMB based exploits
Necro (aka N3Cr0m0rPh) targets both Linux and Windows devices, with heightened activity observed at the start of the year as part of a malware campaign dubbed “FreakOut” that was found exploiting vulnerabilities in NAS devices running on Linux machines to co-opt the machines into a botnet for launching (DDoS) attacks and mining Monero cryptocurrency.
In addition to its DDoS and RAT-like functionalities to download and launch additional payloads, Necro is designed with stealth in mind by installing a rootkit that hides its presence on the system.
A version of the botnet, recently released includes exploits for EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0145), both of which abuse a remote code execution vulnerability in Windows SMB protocol. These new additions serve to highlight that the malware author is actively developing new methods of spreading by taking advantage of publicly disclosed vulnerabilities.
The incorporation of a polymorphic engine to mutate its source code with every iteration while keeping the original algorithm intact in a “rudimentary” attempt to limit the chances of being detected.
Necro Python bot shows an actor that follows the latest development in remote command execution exploits on various web applications and includes the new exploits into the bot.This increases its chances of spreading and infecting systems. Users need to make sure to regularly apply the latest security updates to all of the applications, not just operating systems.
