Vulnerabilityhigh
Necro Python bot adds new exploits and Tezos mining to its bag of tricks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-0144 | Remote Code Execution in Microsoft SMBv1 (EternalBlue) affecting Windows and Siemens devices | 8.8 | 99% | KEVRansomwarePoC ×6 | KEV |
| CVE-2020-14882 | Remote Code Execution in Oracle WebLogic Server | 9.8 | 100% | KEVPoC ×3 | KEV |
| CVE-2021-3129 | Unauthenticated RCE in Laravel Ignition error-page package (facade/ignition) | 9.8 | 100% | KEVRansomwarePoC ×3 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | can6dodp.servepics.com | fferent download server, which has not been used previously can6dodp[.]servepics[.]com. Tezos (XTZ) mining was observed in Talos honeypots. In |
| domain | cloud-miner.de | the final location of the mining payload, which is hxxps://cloud-miner[.]de/tkefrep/tkefrep[.]js?tkefrep=bs?nosaj=faster.xmr2. The at |
| domain | ublock-referer.dev | well as C2 for the Javascript portion of the bot on hxxps://ublock-referer[.]dev/. This server also hosts the main loader campaign.js, ref |
| ipv4 | 1.0.0.1 | resolver configuration to point to Cloudflare DNS servers, 1.0.0.1 and 1.1.1.1, potentially to avoid the detection of its acti |
| ipv4 | 1.1.1.1 | nfiguration to point to Cloudflare DNS servers, 1.0.0.1 and 1.1.1.1, potentially to avoid the detection of its activity in the |
| url | https://cloud-miner.de/tkefrep/tkefrep.js?tkefrep=bs?nosaj=faster.xmr2 | s reveal the final location of the mining payload, which is hxxps://cloud-miner[.]de/tkefrep/tkefrep[.]js?tkefrep=bs?nosaj=faster.xmr2. The attacker-controlled server hosting the miner loade |
| url | https://ublock-referer.dev/ | ader as well as C2 for the Javascript portion of the bot on hxxps://ublock-referer[.]dev/. This server also hosts the main loader campaign.js, refe |
From the original article
13 min read at blog.talosintelligence.com
By Vanja Svajcer , with contributions from Caitlin Huey and Kendall McKay . Some malware families stay static in terms of their functionality. But a newly discovered malware campaign utilizing the Necro Python bot shows this actor is adding new functionality and improving its chances of infecting vulnerable systems.
By Vanja Svajcer · blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.