Botnet continue to exploit vulnerabilities and FICORA botnet analysis
Summary Back to December 26, 2024, FortiGuard Labs noticed a new variant called "FICORA" frequently spread through documented D-Link vulnerabilities that allow remote attackers to execute malicious commands like downloading malware, brute force attacks, and DDoS flooding attacks on victim hosts. Analysis Why call the botnet named “FICORA”? FICORA bot named from malware inside strings Figure1- special strings The shell script executes multiple strategies , such as wget, ftpget, tftp, and curl, to get malware FICORA. Figure2-downloader with multiple strategies for get malware The shell script kills all processes with the same file extension. Figure3-downloader with kill -9 command The shell script tries to find and kill any process containing the keyword “dvrHelper,” which can decode from hex to strings; below is a small part. Figure4- malware inside hexadecimal script Figure5- malware inside script wit...