MalwareUsed by 1 actor

LolFMe

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Keksec

A new variant of the LOLFME botnet originally attributed to the KekSec team. This variant retains functionality similar to previous wipers and introduces a new behavior: Wiping a device if it fails to communicate with a C2 IP address.

via forescoutforescout.com

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078.001Default AccountsEvidence1

devices with weak credentials, such as [('support', 'support'), ('user', 'user'), ('admin', '1234') ... ('root', 'root')]

T1190Exploit Public-Facing ApplicationEvidence1

The initial infection was identified making a drive-by attempt to /shell at a web server with an interesting payload attached to the “value” string.

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

The C2 can send one of the following instructions, which the bot will execute

Persistence

1 technique

T1078.001Default AccountsEvidence1

devices with weak credentials, such as [('support', 'support'), ('user', 'user'), ('admin', '1234') ... ('root', 'root')]

Privilege Escalation

1 technique

T1078.001Default AccountsEvidence1

devices with weak credentials, such as [('support', 'support'), ('user', 'user'), ('admin', '1234') ... ('root', 'root')]

Stealth

5 techniques

T1036MasqueradingEvidence1

begins execution by obfuscating the process name of its executable to a random sequence derived from the victim machine’s time.

T1070Indicator RemovalEvidence1

CLEAN – Calls the CleanDevice() function, shown below, to remove logs and temporary files, and flush and stop iptables and firewalld.

T1070.002Clear Linux or Mac System LogsEvidence1

This command wipes the authentication log at /var/log/auth.log and the shell histories at bash_history and zsh_history by linking them to /dev/null

T1078.001Default AccountsEvidence1

devices with weak credentials, such as [('support', 'support'), ('user', 'user'), ('admin', '1234') ... ('root', 'root')]

T1497.001System ChecksEvidence1

added a check to detect if the parent process of the malware is strace, gdb, lldb or ltrace in order to evade dynamic analysis.

Defense Impairment

1 technique

T1222File and Directory Permissions ModificationEvidence1

This command wipes the authentication log at /var/log/auth.log and the shell histories at bash_history and zsh_history by linking them to /dev/null

Credential Access

1 technique

T1110Brute ForceEvidence1

telnet_init : Scans the local network using Telnet for devices with weak credentials

Discovery

1 technique

T1497.001System ChecksEvidence1

added a check to detect if the parent process of the malware is strace, gdb, lldb or ltrace in order to evade dynamic analysis.

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

The client first initializes a TCP socket to a hardcoded C2 address... and waits for further instructions from C2.

T1219Remote Access ToolsEvidence1

The client first initializes a TCP socket to a hardcoded C2 address... It then sends the host’s build architecture... and waits for further instructions from C2.

Impact

4 techniques

T1485Data DestructionEvidence1

What Is Wiper Malware? Wipers are malware that delete data on a device or make it inaccessible. They can be used for sabotage, to destroy evidence of an attack or simply to make a device unusable.

T1498Network Denial of ServiceEvidence1

HTTP – Initiates an HTTP flood attack... UDP / TCP – Initiates a flood attack where the C2 can choose to spoof the source IP.

T1499Endpoint Denial of ServiceEvidence1

IoT wipers often rewrite important parts of the firmware of an IoT device, rendering that device useless, so they are also known as 'brickers'.

T1561.001Disk Content WipeEvidence1

These behaviors include deleting data, writing junk data on specific device paths, and rebooting devices.

INDICATORS OF COMPROMISE

IOCs tracked for this family

5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app2 years ago

ip.v4●●●●●●●●●●●●View more in app2 years ago

hash.sha256●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

forescoutNews

Jul 18, 2024

Emerging IoT Wiper Malware: Kaden and New LOLFME Botnet Variants - Forescout

KekSec-linked botnet variant under active development that evades analysis, scans via Telnet for weak credentials, executes DDoS modules, and wipes devices either when C2 communication fails or via the 'bricklol' command.

securonix blogNews

Dec 8, 2022

Detecting EnemyBot - Securonix Initial Coverage Advisory - Securonix

Referenced as a similar botnet with structural and string overlaps to EnemyBot; described as short-lived and leveraging multi-architecture support and RCE as an initial foothold.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching5

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

LolFMe

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Keksec

via forescoutforescout.com

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078.001Default AccountsEvidence1

devices with weak credentials, such as [('support', 'support'), ('user', 'user'), ('admin', '1234') ... ('root', 'root')]

T1190Exploit Public-Facing ApplicationEvidence1

The initial infection was identified making a drive-by attempt to /shell at a web server with an interesting payload attached to the “value” string.

Execution

1 technique

T1059Command and Scripting InterpreterEvidence1

The C2 can send one of the following instructions, which the bot will execute

Persistence

1 technique

T1078.001Default AccountsEvidence1

devices with weak credentials, such as [('support', 'support'), ('user', 'user'), ('admin', '1234') ... ('root', 'root')]

Privilege Escalation

1 technique

T1078.001Default AccountsEvidence1

devices with weak credentials, such as [('support', 'support'), ('user', 'user'), ('admin', '1234') ... ('root', 'root')]

Stealth

5 techniques

T1036MasqueradingEvidence1

begins execution by obfuscating the process name of its executable to a random sequence derived from the victim machine’s time.

T1070Indicator RemovalEvidence1

CLEAN – Calls the CleanDevice() function, shown below, to remove logs and temporary files, and flush and stop iptables and firewalld.

T1070.002Clear Linux or Mac System LogsEvidence1

This command wipes the authentication log at /var/log/auth.log and the shell histories at bash_history and zsh_history by linking them to /dev/null

T1078.001Default AccountsEvidence1

devices with weak credentials, such as [('support', 'support'), ('user', 'user'), ('admin', '1234') ... ('root', 'root')]

T1497.001System ChecksEvidence1

added a check to detect if the parent process of the malware is strace, gdb, lldb or ltrace in order to evade dynamic analysis.

Defense Impairment

1 technique

T1222File and Directory Permissions ModificationEvidence1

This command wipes the authentication log at /var/log/auth.log and the shell histories at bash_history and zsh_history by linking them to /dev/null

Credential Access

1 technique

T1110Brute ForceEvidence1

telnet_init : Scans the local network using Telnet for devices with weak credentials

Discovery

1 technique

T1497.001System ChecksEvidence1

added a check to detect if the parent process of the malware is strace, gdb, lldb or ltrace in order to evade dynamic analysis.

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

The client first initializes a TCP socket to a hardcoded C2 address... and waits for further instructions from C2.

T1219Remote Access ToolsEvidence1

The client first initializes a TCP socket to a hardcoded C2 address... It then sends the host’s build architecture... and waits for further instructions from C2.

Impact

4 techniques

T1485Data DestructionEvidence1

What Is Wiper Malware? Wipers are malware that delete data on a device or make it inaccessible. They can be used for sabotage, to destroy evidence of an attack or simply to make a device unusable.

T1498Network Denial of ServiceEvidence1

HTTP – Initiates an HTTP flood attack... UDP / TCP – Initiates a flood attack where the C2 can choose to spoof the source IP.

T1499Endpoint Denial of ServiceEvidence1

IoT wipers often rewrite important parts of the firmware of an IoT device, rendering that device useless, so they are also known as 'brickers'.

T1561.001Disk Content WipeEvidence1

These behaviors include deleting data, writing junk data on specific device paths, and rebooting devices.

INDICATORS OF COMPROMISE

IOCs tracked for this family

5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app2 years ago

ip.v4●●●●●●●●●●●●View more in app2 years ago

hash.sha256●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

forescoutNews

Jul 18, 2024

Emerging IoT Wiper Malware: Kaden and New LOLFME Botnet Variants - Forescout

securonix blogNews

Dec 8, 2022

Detecting EnemyBot - Securonix Initial Coverage Advisory - Securonix

Referenced as a similar botnet with structural and string overlaps to EnemyBot; described as short-lived and leveraging multi-architecture support and RCE as an initial foothold.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching5

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.