The Check Point researchers have discovered a new variant of malware that they have dubbed FreakOut, created by a well-known attacker who goes by the name of Freak or Fl0urite on various forums. This variant exploits several vulnerabilities to create an IRC botnet with two main objectives: to carry out DDoS attacks against various organizations, and, on the other hand, to mine cryptocurrencies.<\/p>\n\n\n\n
The FreakOut botnet is targeted at Linux-based systems including the TerraMaster operating system, which manages the TerraMaster network-attached storage servers, the Zend framework, designed to build web application services using PHP and Liferay Portal, a platform web application that allows users to create portals and websites.<\/p>\n\n\n\n
By exploiting the vulnerabilities, it is possible to execute commands on the server with the final intention of downloading the “out.py” script, developed in Python2, which would indicate that the attacker intends to take advantage particularly of those computers that still have this version installed without Python support.<\/p>\n\n\n\n
Checkpoint researchers have said that this botnet is based on a separate botnet called “N3Cr0m0rPh”, which has been offered for sale or rent on underground forums since 2015.<\/p>\n\n\n\n
It has been noted that once the FreakOut malware finds and exploits a vulnerability, it downloads a Python script that creates a channel between the compromised system and the command and control server and creates these botnet functionalities:<\/p>\n\n\n\n
\u25b8Collect device information, including MAC address and memory information<\/em><\/strong><\/p>\n\n\n\n \u25b8Implement brute force attacks that attempt to infect other devices within the network<\/em><\/strong><\/p>\n\n\n\n \u25b8Scan ports<\/em><\/strong><\/p>\n\n\n\n \u25b8Kill a process by name or ID<\/em><\/strong><\/p>\n\n\n\n \u25b8Package and unzip code using obfuscation techniques to provide random names to functions and variables<\/em><\/strong><\/p>\n\n\n\n See also: The Check Point researchers have discovered a new variant of malware that they have dubbed FreakOut, created by a well-known attacker who goes by the name of Freak or Fl0urite on various forums. This variant exploits several vulnerabilities to create an IRC botnet with two main objectives: to carry out DDoS attacks against various organizations, […]<\/p>\n","protected":false},"author":1,"featured_media":2081,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[14,10],"tags":[97,36],"class_list":["post-2080","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-botnets","category-cybersecurity","tag-botnet","tag-cybersecurity"],"yoast_head":"\n
IPStorm \u2013 What we know about this botnet<\/a>
Lemon Duck \u2013 Botnet that Attacks Linux and Windows<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"