Necurs

It has also been used to promote pump-and-dump stock scams, fake pharmaceutical spam emails and “Russian dating” scams.

They have all been used to deliver much of the spam, phishing lures and malware that was received globally.

The malware infects a victim’s system by being dropped by other malware, through either spammed email attachments or malicious advertisements.

This is the closest it gets to its previous malicious spam runs: Attaching a URL in the email and tricking a victim into clicking on the link to download a malicious file.

it can send spam using the logged-in email accounts on a victim’s machine

Once on a system, Necurs utilizes its kernel mode rootkit capabilities to disable a large number of security applications, including Windows Firewall, both to protect itself and other malware on the infected system.

Necurs malware uses this to its advantage by changing the folder icon to trick the victim into thinking that it’s a different file type... The .URL file disguised as a .ZIP file of a voicemail message

the .NET module can delete the last email sent from the victim’s email account and catch all alerts.

Necurs starts by checking internet connectivity by resolving facebook.com or microsoft.com... The purpose of the domains is to detect simulated internet in lab environments.

Necurs sleeps between 1 and 20 seconds after each failed connection attempt, which mounts up to about 5 minutes before the malware moves on to the next stage.

it is capable of sending emails and stealing credentials from Internet Explorer, Chrome, and Firefox.

It has also been used to attack other computers on the internet, steal credentials for online accounts, and steal people’s personal information and confidential data.

The modules execute commands such as “net view” and “net user” to check for the following strings

The Necurs modules check if the machines have files that contain any of the following strings that exist under “%APPDATA%” such as: WALLET.DAT BITCOIN-QT ELECTRUM

The malware then contacts three NTP pools to get the accurate date and time.

The modules execute “net user” and “net domain” to see if a machine is connected to a network with more than 100 users.

Necurs starts by checking internet connectivity by resolving facebook.com or microsoft.com... The purpose of the domains is to detect simulated internet in lab environments.

Necurs sleeps between 1 and 20 seconds after each failed connection attempt, which mounts up to about 5 minutes before the malware moves on to the next stage.

Interestingly, Necurs does not infect computers using Russian as a language.

The .URL file accesses the remote server, which then executes through the Server Message Block (SMB) protocol

The module will search for the files with email strings in the filenames and send those strings back.

it can access a victim’s contact list stored in email clients and the email addresses with which a victim has previously corresponded.

It has also been used to attack other computers on the internet, steal credentials for online accounts, and steal people’s personal information and confidential data.

The Necurs botnet makes use of hardcoded domains and multiple layers of DGAs to attempt to guarantee reliable command and control (C2) capabilities.

Threat actors use peer-to-peer (P2P) botnets like these to build a platform that can later be used to carry out malicious operations... The need for increased takedown resistance eventually drove botnet operators to adapt and explore peer-to-peer approaches.

“The technique, named Blockchain Dead Drops (BDD), stores payloads in on-chain transactions and smart contracts where infected devices can retrieve them on demand.” The article explicitly maps it to “T1102.001 (Web Service: Dead Drop Resolver).”

« Blockchain Dead Drops (BDD) ... stocker des instructions de malware ou des configurations C2 sur des blockchains publiques » ; « Smart contracts sur Polygon utilisés comme résolveurs C2 ».

The Necurs botnet has historically been used to deliver a torrent of other high profile cyber threats to the world, including the GameOver Zeus and Dridex banking trojans, Locky ransomware and, more recently, the banking trojan turned all purpose cybercrime-as-a-service, Trickbot.

In April, we observed that it pushed the remote access trojan FlawedAmmyy onto its bots.

We would usually provide in-depth details here about the technical functionality of the Necurs malware, reverse engineering information, the use of multiple layers of Domain Generation Algorithms (DGAs) – including .bit for blockchain based name to IP address resolution...

README.md ... Domain Generation Algorithms (DGAs) of Malware reimplemented in Python.

In late May, we saw some Necurs modules that exfiltrated email accounts and sent them to hxxp://185[.]176[.]221[.]24/l/s[.]php.

In March, we saw Necurs pushing a Monero Miner — XMRig — to its bots.

Necurs is also known for distributing financially targeted malware and ransomware, cryptomining, and even has a DDoS (distributed denial of service) capability that has not yet been activated but could be at any moment.

Once on a system, Necurs utilizes its kernel mode rootkit capabilities to disable a large number of security applications, including Windows Firewall, both to protect itself and other malware on the infected system.