Security News Adylkuzz, the new virus that follows in WannaCry’s footsteps

[spaceoctopus]

Adylkuzz, the malware that steals virtual money from thousands of computers
All investigations seem to indicate that WannaCry, the global attack that shocked the world last week, was just the tip of the iceberg in terms of cyber-security threats. The new cyber-attack currently underway, called Adylkuzz, is potentially much more dangerous than its predecessor, as it is designed to steal virtual money from computers without users’ knowledge.

Instead of locking computer files and demanding a ransom for them, just like WannaCry did, this new malware has infected thousands of computers silently, turning them into zombies in the hands of cyber-crooks. Adylkuzz is a botnet that creates a network of compromised computers it can remotely control, and worse still, it has been active since April 24.

 

[GonzitoVir]

Active since April 24 but haven't made it in the news until now, probably because it's not as immediately catastrophic as Wannacry.
They say Adylkuzz follows Wannacry steps, but differ in the way they operate and their goals.
Thank you for the share spaceoctopus!

 

[Fritz]

Well I'm not worried about the virtual money since I got as much of that as in cold, hard cash.

The botnet part is bad of course. Has anyone thrown that boy against an AV yet?

 

[GonzitoVir]

The large-scale attack, said to have easily infected more endpoints that WannaCry, predates the widely publicized ransomware threat by more than a week. Bitdefender confirmed the findings of security firm Proofpoint today, showing that Adylkuzz:

- uses the same EternalBlue exploit as WannaCry (alongside the NSA backdoor called DoublePulsar)
- packs a Trojan horse containing a Monero (electronic currency similar to Bitcoin) mining tool
- blocks Microsoft Server Message Block (SMB) on TCP port 445 ensuring persistency on the victim’s computer

Here’s the irony, though: because it exploits the same vulnerability as the WannaCry ransomware, and because it blocks the vulnerable 445 port, Adylkuzz is actually helping reduce the number of WannaCry infections out there.

Source: As WannaCry Makes Headlines, Stealthier Adylkuzz Cryptocurrency...

 

[GonzitoVir]

Well I'm not worried about the virtual money since I got as much of that as in cold, hard cash.

The botnet part is bad of course. Has anyone thrown that boy against an AV yet?

It seems like most antivirus are catching it. Symantec even rates it as "Low Risk Level"
https://www.symantec.com/security_response/writeup.jsp?docid=2017-051707-0237-99

 

[tryfon]

We should keep seeing more and more malware samples utilizing these exploits in the future