DirtyMoe Botnet Gains New Exploits in Wormable Module to Spread Rapidly

The malware known as DirtyMoe has gained new worm-like
propagation capabilities that allow it to expand its reach without
requiring any user interaction, the latest research has found.

“The worming module targets older well-known vulnerabilities,
e.g., EternalBlue^[1]
and Hot Potato^[2]
Windows privilege escalation,” Avast researcher Martin Chlumecký
said^[3]
in a report published Wednesday.

“One worm module can generate and attack hundreds of thousands
of private and public IP addresses per day; many victims are at
risk since many machines still use unpatched systems or weak
passwords.”

Active since 2016, the DirtyMoe botnet^[4]
is used for carrying out cryptojacking and distributed
denial-of-service (DDoS) attacks, and is deployed by means of
external exploit kits like PurpleFox^[5]
or injected installers of Telegram Messenger.

Also employed as part of the attack sequence is a DirtyMoe
service that triggers the launch of two additional processes,
namely the Core and the Executioner, which is used to load the
modules for Monero mining and to spread the malware in a worm-like
manner.

The worming modules attack victim machines by using several
vulnerabilities to install the malware, with each module targeting
a specific flaw based on information gathered post reconnaissance
–

• CVE-2019-9082: ThinkPHP – Multiple PHP Injection RCEs
• CVE-2019-2725: Oracle Weblogic Server – ‘AsyncResponseService’
  Deserialization RCE
• CVE-2019-1458: WizardOpium Local Privilege Escalation
• CVE-2018-0147: Deserialization Vulnerability
• CVE-2017-0144: EternalBlue SMB Remote Code Execution
  (MS17-010)
• MS15-076: RCE Allow Elevation of Privilege (Hot Potato Windows
  Privilege Escalation)
• Dictionary attacks aimed at MS SQL Servers, SMB, and Windows
  Management Instrumentation (WMI) services with weak passwords

“The main goal of the worming module is to achieve RCE under
administrator privileges and install a new DirtyMoe instance,”
Chlumecký explained, adding one of the component’s core functions
is to generate a list of IP addresses to attack based on the
geological location of the module.

Furthermore, another in-development worming module was found to
contain exploits targeting PHP, Java Deserialization, and Oracle
Weblogic Servers, implying that the attackers are looking to
broaden the scope of the infections.

“Worming target IPs are generated utilizing the cleverly
designed algorithm that evenly generates IP addresses across the
world and in relation to the geological location of the worming
module,” Chlumecký said. “Moreover, the module targets local/home
networks. Because of this, public IPs and even private networks
behind firewalls are at risk.”