Security researchers at Kaspersky has came across a cross-platform malware which is capable of running on Windows, Mac and Linux.
The malware is completely written in Java. Even the exploit used for delivering the malware is also well-known Java exploit(CVE-2013-2465) which makes the campaign completely cross-platform.
Once the bot has infected a system, it copies itself into user's home directory as well as add itself to the autostart programs list to ensure it gets executed whenever user reboots the system.
Once the configuration is done, the malware generates an unique identifier and informs its master. Cyber criminals later communicates with this bot through IRC protocol.
The main purpose of this bot is appeared to be participate in Distributed-denial-of-service(DDOS) attacks. Attacker can instruct the bot to attack a specific address and specify a duration for the attack.
The malware uses few techniques to make the malware analysis and detection more difficult. It uses the Zelix Klassmaster obfuscator. This obfuscator not only obfuscate the byte code but also encrypts string constants.
All machines running Java 7 update 21 and earlier versions are likely to be vulnerable to this attack.
The malware is completely written in Java. Even the exploit used for delivering the malware is also well-known Java exploit(CVE-2013-2465) which makes the campaign completely cross-platform.
Once the bot has infected a system, it copies itself into user's home directory as well as add itself to the autostart programs list to ensure it gets executed whenever user reboots the system.
Once the configuration is done, the malware generates an unique identifier and informs its master. Cyber criminals later communicates with this bot through IRC protocol.
The main purpose of this bot is appeared to be participate in Distributed-denial-of-service(DDOS) attacks. Attacker can instruct the bot to attack a specific address and specify a duration for the attack.
The malware uses few techniques to make the malware analysis and detection more difficult. It uses the Zelix Klassmaster obfuscator. This obfuscator not only obfuscate the byte code but also encrypts string constants.
All machines running Java 7 update 21 and earlier versions are likely to be vulnerable to this attack.
Comments
Post a Comment