Loading malware…
Lucifer is a multi-platform malware family that evolved from a Windows cryptomining threat into a hybrid botnet supporting distributed denial-of-service activity, remote command-and-control, remote execution, and self-propagation. It has been associated with campaigns linked to BlackSquid and Spreadminer/Rudeminer through shared code traits and operational overlaps. Lucifer has targeted Windows, Linux, and IoT environments, with observed victim organizations in sectors including manufacturing, legal, insurance, and banking.
On Windows, Lucifer combines Monero mining with worm-like propagation and post-compromise reconnaissance. Documented behaviors include collecting the victim username and IP address, identifying processes associated with remote connections, scanning for open ports such as those commonly used for RPC and Microsoft SQL Server, and using WMI to authenticate to remote machines for propagation. It can establish persistence through scheduled tasks and Registry Run keys. It also stores or checks mining-related configuration in the Registry. Network communications include decrypting its command-and-control address at runtime and applying custom XOR-based obfuscation to initial command-and-control traffic.
Lucifer’s propagation has relied on exploitation of known vulnerabilities and brute-force techniques. Public reporting has highlighted exploitation of CVE-2018-10561 in Dasan GPON routers as a major IoT infection vector, while Windows spreading used older public exploits and credential guessing. Infected Windows hosts were used to spread laterally within networks and to additional remote targets.
Linux variants support mining and broader command-and-control functionality, including file download and execution and remote command execution. Linux persistence has been achieved through standard startup mechanisms such as rc.local and cron. ARM and MIPS variants have been observed with a reduced feature set focused primarily on DDoS operations. Parts of Lucifer’s DDoS implementation have been linked to code from the Storm Attack Tool VIP 2009 program, indicating code reuse in the botnet component.
Overall, Lucifer is best characterized as a cross-platform cryptomining botnet with DDoS and worm-like capabilities, combining monetization through illicit mining with additional botnet functionality and opportunistic propagation across enterprise and embedded targets.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
10 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Lucifer is a Windows crypto miner and DDOS hybrid malware... What started as a miner with self-spreading capabilities that targeted the Windows system, has now evolved into a multi-platform and multi-architecture malware targeting Linux, and IoT devices as well.
2017-06-13 CVE-2017-8464 LNK Remote Code Execution Vulnerability Blacksquid, Lucifer, etc. | CVE-2017-8464 ... Exploited in the wild: Blacksquid, Lucifer, etc.
Lucifer is a Windows crypto miner and DDOS hybrid malware... What started as a miner with self-spreading capabilities that targeted the Windows system, has now evolved into a multi-platform and multi-architecture malware targeting Linux, and IoT devices as well.
Microsoft Windows SMB Remote Code Execution (MS17-010: CVE-2017-0144) | Lucifer is a Windows crypto miner and DDOS hybrid malware... What started as a miner with self-spreading capabilities that targeted the Windows system, has now evolved into a multi-platform and multi-architecture malware targeting Linux, and IoT devices as well.
The current main attack vector for IoT devices is through exploitation of the vulnerability known as CVE-2018-10561, which targets unpatched Dasan GPON router devices. | Lucifer is a Windows crypto miner and DDOS hybrid malware... What started as a miner with self-spreading capabilities that targeted the Windows system, has now evolved into a multi-platform and multi-architecture malware targeting Linux, and IoT devices as well.
Lucifer is a Windows crypto miner and DDOS hybrid malware... What started as a miner with self-spreading capabilities that targeted the Windows system, has now evolved into a multi-platform and multi-architecture malware targeting Linux, and IoT devices as well.
Lucifer is a Windows crypto miner and DDOS hybrid malware... What started as a miner with self-spreading capabilities that targeted the Windows system, has now evolved into a multi-platform and multi-architecture malware targeting Linux, and IoT devices as well.
Microsoft Windows SMB Remote Code Execution (MS17-010: CVE-2017-0145) | Lucifer is a Windows crypto miner and DDOS hybrid malware... What started as a miner with self-spreading capabilities that targeted the Windows system, has now evolved into a multi-platform and multi-architecture malware targeting Linux, and IoT devices as well.
Lucifer is a Windows crypto miner and DDOS hybrid malware... What started as a miner with self-spreading capabilities that targeted the Windows system, has now evolved into a multi-platform and multi-architecture malware targeting Linux, and IoT devices as well.
Lucifer is a Windows crypto miner and DDOS hybrid malware... What started as a miner with self-spreading capabilities that targeted the Windows system, has now evolved into a multi-platform and multi-architecture malware targeting Linux, and IoT devices as well.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
The content repeatedly describes threat actors and malware using WMI/WMIC/wmiexec for remote execution, lateral movement, discovery, persistence, and administrative actions; e.g., 'APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit' and 'Scattered Spider used Windows Management Instrumentation (WMI) to move laterally via Impacket.'
The line added in the crontab causes Linux to execute the malware every minute.
If the file /etc/rc.local exists, the malware either writes or appends this line in the file: MALWARE_PATH start
The line added in the crontab causes Linux to execute the malware every minute.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
Across the content, malware repeatedly 'adds Registry Run keys', 'creates Registry entries', 'modifies the Windows Registry', or 'overwrites registry keys' to maintain persistence.
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
If the file /etc/rc.local exists, the malware either writes or appends this line in the file: MALWARE_PATH start
The line added in the crontab causes Linux to execute the malware every minute.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
AdFind can extract subnet information from Active Directory; actors used ipconfig /all after exploiting a machine; numerous malware and groups used ipconfig, ifconfig, arp, route, netsh, nbtstat, NBTscan, and related APIs to gather IP, MAC, DNS, DHCP, gateway, proxy, domain, ARP cache, routing, and adapter details.
The content repeatedly describes malware and threat actors collecting the username, identifying the current user, enumerating logged-on users, or running commands such as whoami, query user, and quser to determine user context on compromised systems.
The content repeatedly describes threat actors and malware performing network scanning, port scanning, service enumeration, OS fingerprinting, and identifying open ports/services across victim environments.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."
First it checks if any of these devices exist: /dev/watchdog or /dev/misc/watchdog.
Examples include 'Bazar can also check if the Russian language is installed,' 'DropBook has checked for the presence of Arabic language,' 'Maze has checked the language of the infected system,' and 'SynAck ... checks installed keyboard layouts to estimate if it has been launched from a certain list of countries.'
Infected Windows machines then continue to spread the malware both inside the network and to remote targets.
Many entries describe XOR, XOR/ADD, bitwise NOT and XOR, ROR plus XOR, hexadecimal encoding after encryption, and custom encoding/obfuscation of HTTP traffic or beacons.
The malware has several capabilities: multiple types of DDOS attacks, full command-and-control operations able to download and execute files, remote command execution... After the threads are set up, the malware starts an infinite loop and maintains a constant connection to the C&C.
41 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
37 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named malware family listed as detectable via favicon hash hunting of exposed infrastructure.
Listed as a malware/tool name in a collection of SHA-256 hashes intended to help identify C2 infrastructure, open directories, and phishing assets.
The content presents Lucifer as a custom payload encryption/decryption routine used to encrypt shellcode or a payload before execution. The sample allocates executable memory, copies the decrypted payload into it, and triggers execution via EnumDesktopsA, indicating use as a malware payload protection/obfuscation component rather than a standalone malware family.
Botnet/trojan malware that can identify the username on a compromised host.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.