Summary

Lemon Duck is a monerocrypto-mining malware. It starts with a single infection and spreads rapidly across the entire network converting the resources of an organization into cryptocurrency mining slaves.

This malware was first spotted in China last October 2019 but has hence spread to other parts of the world.

Lemon Duck malware was written in Python using PyInstaller for compilation. This malware’s main strategy is fileless infection using PowerShell modules. The infection on the network happens through the exploitation of a critical SMB vulnerability (CVE-2017-0144) and brute-force attacks.

Capabilities

• Exploit
• Information Theft
• Persistence

Impact

• Exfiltration Over Command and Control Channel
• Resource Hijacking

Malware routine can be found on the following virus reports:

• Threat Encyclopedia: Worm

Indicators of Compromise

t[.]zer2[.]com/{uri} – Used to download the layered PowerShell scripts and reporting system information

down[.]ackng[.]com – Used to download the URL of the miner payload

lpp[.]zer2[.]com:443 – The payload’s mining pool

lpp[.]ackng[.]com:443 – The second mining pool