New upgrades have been made to the Python-based “self-replicating, polymorphic bot” called Necro in order to improve its chances of infecting vulnerable systems and evading detection.
Necro Python bot has been in development since 2015 and the developer behind the malware is working hard to ramp up its capabilities.
Researchers from Cisco Talos published a report on the bot, while the botnet’s development progress was documented in January 2021 by both CheckPoint Research (CPR) and Netlab 360, tracked separately as FreakOut and Necro.
The developer behind the Necro Python bot has made numerous changes to increase the power and versatility of the bot, including exploits for over 10 different web applications and the SMB protocol that are being weaponized in the bot’s recent campaigns.
Exploits are included for vulnerabilities in software such as VMWare vSphere, SCO OpenServer, and the Vesta Control Panel.
A version of the botnet that was released on May 18, also includes exploits for EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0147).
Necro Python will then establish a connection to a command-and-control (C2) server to maintain contact with its operator, receive commands, to exfiltrate data, or to deploy additional malware payloads.
A new addition to the bot is a cryptocurrency miner, XMRig, that can generate Monero (XMR) by stealing the compromised machine’s computing resources.
Some of the other features include the ability to launch distributed denial-of-service (DDoS) attacks, data exfiltration, and network sniffing.
A user-mode rootkit is also installed to establish persistence by ensuring the malware launches whenever a user logs in, and to hide its presence by burying malicious processes and registry entries.
Another notable upgrade is the bot’s polymorphic abilities. It has a module to allow developers to view code as it would be seen by an interpreter before being compiled to bytecode, and this module has been integrated into an engine that could allow runtime modifications.
The engine runs every time the bot is started and it will read its own file before morphing the code, a technique that can make it difficult to detect a bot.
The researchers added that users must make sure to regularly apply the latest security updates to all of the applications, not just operating systems.
Credit : Talos Blog