Loading malware…
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
16 distinct techniques documented for this family, organized by ATT&CK tactic.
This is an attempt for that attacker to not only compromise the server but also clients connecting to it.
Necro Python ... is actively exploiting some services, including a new exploit added to its arsenal. This new exploit targets Visual Tools DVR VX16 4.2.28.0 ... Successful exploitation will download the bot into the system and install a Monero miner.
shell launch a process using subprocess.Popen() ... execute executes a file | revshell launch a reverse shell
Necro injects javascript code to html, htm, php and .js files found on the compromised server.
Necro bot is an interesting python bot that has many functions which include the following: ... Installing a Windows rootkit
The script has its own polymorphic engine to morph itself every execution which can bypass signature-based defenses. This works by reading every string in its code and encrypting it using a hardcoded key.
Necro bot is an interesting python bot that has many functions which include the following: Network Sniffer
Necro bot is an interesting python bot that has many functions which include the following: ... Spreading by brute-force
Necro bot is an interesting python bot that has many functions which include the following: Network Sniffer
The scanner function of the bot scans for the following ports and if available, it launches its attack. TARGET_PORTS = [22, 80, 443, 8081, 8081, 7001]
Necro connects to the CnC server, gtmpbeaxruxy.myftp.org, via IRC to receive commands
When the bot receives the “ torflood ” command, it uses a set of TOR proxies for its DDOS attacks.
Successful exploitation will download the bot into the system and install a Monero miner.
Necro uses DGA for both its CnC and download server. It selects from a list of dynamic DNS services as its domain ... In effect, it can generate up to 253 unique domains.
This works by reading every string in its code and encrypting it using a hardcoded key.
Successful exploitation will download the bot into the system and install a Monero miner ... Aside from the bot, the payload will install a XMRig Monero miner
Participating in DDoS attacks ... udpflood UDP flood synflood SYN flood tcpflood TCP flood slowloris slowloris DDoS attack httpflood launch httpflood torflood launch DDoS using TOR SOCKS proxies loadamp initialize amplification attack reflect launch DNS reflection attack
46 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.