Necro Python Malware Upgrades With New Exploits and Crypto Mining Capabilities

New upgrades have been made to a Python-based “self-replicating,
polymorphic bot” called Necro in what’s seen as an attempt to
improve its chances of infecting vulnerable systems and evading
detection.

“Although the bot was originally discovered earlier this year,
the latest activity shows numerous changes to the bot, ranging from
different command-and-control (C2) communications and the addition
of new exploits for spreading, most notably vulnerabilities in
VMWare vSphere, SCO OpenServer, Vesta Control Panel and SMB-based
exploits that were not present in the earlier iterations of the
code,” researchers from Cisco Talos said^[1]
in a deep-dive published today.

Said to be in development as far back as 2015, Necro^[2]
(aka N3Cr0m0rPh) targets both Linux and Windows devices, with
heightened activity observed at the start of the year as part of a
malware campaign dubbed “FreakOut^[3]” that was found
exploiting vulnerabilities^[4]
in network-attached storage (NAS) devices running on Linux machines^[5]
to co-opt the machines into a botnet for launching distributed
denial-of-service (DDoS) attacks and mining Monero
cryptocurrency.

In addition to its DDoS and RAT-like functionalities to download
and launch additional payloads, Necro is designed with stealth in
mind by installing a rootkit that hides its presence on the system.
What’s more, the bot also injects malicious code to retrieve and
execute a JavaScript-based miner from a remote server into HTML and
PHP files on infected systems.

While previous versions of the malware exploited flaws in
Liferay Portal, Laminas Project, and TerraMaster, the latest
variants observed on May 11 and 18 feature command injection
exploits targeting Vesta Control Panel, ZeroShell 3.9.0, SCO
OpenServer 5.0.7, as well as a remote code execution flaw impacting
VMWare vCenter (CVE-2021-21972^[6]) that was patched by the
company in February.

A version of the botnet, released on May 18, also includes
exploits for EternalBlue^[7]
(CVE-2017-0144) and EternalRomance^[8]
(CVE-2017-0145), both of which abuse a remote code execution
vulnerability in Windows SMB protocol. These new additions serve to
highlight that the malware author is actively developing new
methods of spreading by taking advantage of publicly disclosed
vulnerabilities.

Also of note is the incorporation of a polymorphic engine^[9]
to mutate its source code with every iteration while keeping the
original algorithm intact in a “rudimentary” attempt to limit the
chances of being detected.

“Necro Python bot shows an actor that follows the latest
development in remote command execution exploits on various web
applications and includes the new exploits into the bot,” Talos
researchers said. “This increases its chances of spreading and
infecting systems. Users need to make sure to regularly apply the
latest security updates to all of the applications, not just
operating systems.”