The malware known as DirtyMoe has gained new worm-like propagation capabilities that allow it to expand its reach without requiring any user interaction, the latest research has found.
” One worm module is capable of generating and attacking hundreds of thousands private and public IP addresses every day. Many victims are vulnerable because many computers still have unpatched systems and weak passwords. “
Active since 2016, the DirtyMoe botnet is used for carrying out cryptojacking and distributed denial-of-service (DDoS) attacks, and is deployed by means of external exploit kits like PurpleFox or injected installers of Telegram Messenger.
A DirtyMoe Service is also used in the attack sequence. It triggers the launch two additional processes: the Core and the Executioner. These are used to load the Monero mining modules and spread the malware in an worm-like fashion.
Worming modules infect victim computers by exploiting multiple vulnerabilities. Each module targets a particular flaw, based upon information collected post reconnaissance –
- CVE-2019-9082: ThinkPHP – Multiple PHP Injection RCEs
- CVE-2019-2725: Oracle Weblogic Server – ‘AsyncResponseService’ Deserialization RCE
- CVE-2019-1458: WizardOpium Local Privilege Escalation
- CVE-2018-0147: Deserialization Vulnerability
- CVE-2017-0144: EternalBlue SMB Remote Code Execution (MS17-010)
- MS15-076: RCE Allow Elevation of Privilege (Hot Potato Windows Privilege Escalation)
- Dictionary attacks aimed at MS SQL Servers, SMB, and Windows Management Instrumentation (WMI) services with weak passwords
“The main goal of the worming module is to achieve RCE under administrator privileges and install a new DirtyMoe instance,” Chlumecky explained, adding one of the component’s core functions is to generate a list of IP addresses to attack based on the geological location of the module.
Furthermore, another in-development worming module was found to contain exploits targeting PHP, Java Deserialization, and Oracle Weblogic Servers, implying that the attackers are looking to broaden the scope of the infections.
“Worming target IPs can be generated using a cleverly-designed algorithm which evenly generates IP addresses around the globe and according to the geographical location of the module, Chlumecky stated. The module also targets home networks. Public IPs as well as private networks behind firewalls could be at risk. “