Necurs is Back, Just in Time for Easter
April 1, 2018
After a drastic decline in the volume of spam coming from the Necurs spambot observed by Check Point Telemetry in the past month, the infamous botnet is back once again and is spreading QuantLoader. Necurs, considered to be the world’s largest botnet, was used to distribute several malware families in the past, such as the Locky and Jaff ransomware.
Just before the weekend, Check Point Threat Intelligence sensors spotted a new wave of Necurs spam. The e-mails pretend to be purchase orders or document copies, to lure the victims to open their attachments.
The emails have an attached archive containing a file with a URL. The URL files communicate with hosts in order to download an additional WSF file containing obfuscated JavaScript. This script is used to retrieve a QuantLoader payload, which, in turn, may download additional executables.
After a relatively quiet month, we have seen a peak of around 100,000 emails belonging to the aforementioned campaign in just one day (on March 30th). We have also observed a smaller amount of e-mails (5000) that were sent on March 27th. The sender’s email address on all these messages follows the same pattern, and starts with ‘netadmin’. The low volumes seen at the earlier date indicate that that may have been an initial test before the main wave emerged.
Figure 1: Number of emails sent by Necurs.
POPULAR POSTS
- Artificial Intelligence
- ChatGPT
- Check Point Research Publications
- Check Point Research Publications
- Threat Research
- Artificial Intelligence
- ChatGPT
- Check Point Research Publications
BLOGS AND PUBLICATIONS
- Check Point Research Publications
- Global Cyber Attack Reports
- Threat Research
February 17, 2020
“The Turkish Rat” Evolved Adwind in a Massive Ongoing Phishing Campaign
- Check Point Research Publications
August 11, 2017
“The Next WannaCry” Vulnerability is Here
- Check Point Research Publications
January 11, 2018