Trend Micro: Hackers Add New Features to Necurs botnet malware

Necurs is known as the Malware Trojan Transmission Infrastructure and there have been several cases of spreading of malicious family Trojans that have been proved or suspected to be related to the botnets built by Necurs Trojans, including the notorious rogue viruses Locky, Jaff, mainly bank vouchers. Target Trojan Dridex et al. Necurs is more than just a spam tool. It also has rootkit capabilities and the ability to fight against killing software. Once infected with a user’s machine, it is difficult to get rid of. In addition, Necurs has implemented a modular design that can load different malicious modules according to different tasks, allowing the victim’s computer to be manipulated arbitrarily.

Necurs is a botnet malware that emerged around 2012 and has never stopped optimizing updates since its appearance. Millions of infected computers are under its control and about one million devices are activated each day. Necurs has been engaged in spamming cybercrime activities for many years.

In 2017, the Necurs botnet added C&C server communication capabilities that can be used to launch DDoS attacks. The module spreads malicious traffic through infected hosts, mainly through the HTTP, SOCKSv4, and SOCKSv5 protocols.

McAfee released a report in March 2018 saying that in the fourth quarter of 2017, spam sent by botnet Necurs and Gamut accounted for 97% of all spam. During this time, Necurs used the adult website as a lure for its delivery and transfer program, providing POC for ransomware. The spam activity rate was slightly lower than the previous two months, but the botnet still accounted for 37% of all spam, Necurs accounted for 60%, and most of the e-mail domain names were linked to job-themed phishing and Related to money fraud.

In January 2018, a blog posted by e-mail and cybersecurity company AppRiver stated that AppRiver’s SecureTide filter blocks up to 47 million junk e-mails sent from Necurs botnets to App River customers every day. Distribution of ransomware Locky and GlobeImposter.

The spam e-mails usually issued by Necurs botnets are called pumping and dumping. They rely on sending a lot of spam to promote the user’s interest in specific low-priced stocks. The spammers purchase the stocks at a low price in advance. When the spam activity raises the price, the stock is sold at a higher price.

Trend Micro recently discovered that a new variant of Necurs, the world’s largest spam botnet, appeared and evaded detection via a network shortcut (.url) file.

Necurs previously used an archive file containing a .ZIP file to hide the script download program in order to avoid attachments being detected. The download program was then packaged in another .ZIP file to hide.

Unlike previous Necurs variants, the new variant uses a network shortcut file to send malicious spam to download program scripts.

The script then executes remotely through the Server Message Block (SMB) protocol to evade spam filter detection.

This script will generate a secondary downloader, QuantLoader (this is a common malware family), whose purpose is to obtain boot persistence, and finally download the final, more powerful Payload from this downloader. Botnet operators rarely use this simple spam technique and have always relied on complex infection chains.

Trend Micro researchers pointed out that using QuantLoader may achieve a multiplier effect. First, this download program adds another download phase before downloading the final Payload, which can confuse and evade behavior detection. The QuantLoader is persistent, releasing a copy of itself and creating an autorun registry for execution at startup.

Trend Micro reported in the report that the attacker behind this activity is also using the ability to modify the Internet shortcuts to click on the icon, in order to trick victims into thinking that they are receiving normal folders. In a spam sample, an attacker disguised a URL file as a ZIP file for voice mail.

If the user receives an e-mail attachment that contains the shortcut file shown below, this file is 100% malicious and should never be opened.

In January 2018, the Necurs botnet spawned millions of spam emails. For the first time, large-scale spam campaigns promoted a little-known cryptocurrency Swisscoin cryptocurrency, instead of pushing low-priced stocks, as usual, resulting in Swisscoin lost 40% of the initial transaction price.