{
  "family": "necurs",
  "sample_count": 2,
  "category": "spam_bot",
  "description": "Botnet:Win32/Necurs is a monumental, kernel-level botnet architecture historically responsible for delivering the world's most devastating malware campaigns, including Dridex and Locky ransomware.<br><br><b>Understanding Necurs</b><br>For consumers, Necurs operated entirely in the shadows, silently hooking their machine into a massive spam-sending network. For threat intelligence analysts, Necurs represents a masterclass in resilient infrastructure. At its peak, the botnet controlled over 9 million endpoints. It did not directly steal credentials; instead, it acted as the ultimate 'Initial Access Broker' and delivery mechanism, leasing its massive spamming capabilities to the highest bidders in the cybercrime underworld.<br><br><b>Execution and Evasion Strategies</b><br>Necurs is notorious for its sophisticated kernel-mode rootkit. Upon execution, it drops a malicious driver (often <code>sysprep.sys</code> or a randomly named <code>.sys</code> file) that loads at Ring 0. This driver aggressively defends the botnet components by hooking SSDT (System Service Descriptor Table) functions. It actively terminates security processes, prevents the deletion of its registry keys, and blocks AV network traffic. Necurs utilized a highly complex Domain Generation Algorithm (DGA) for Command and Control, generating thousands of potential C2 domains daily to ensure continuous connectivity.<br><br><b>Indicators of Compromise & Impact</b><br>Incident responders tracking Necurs must hunt for anomalous kernel drivers without valid Microsoft digital signatures. Network analysts will observe massive spikes in outbound SMTP (Port 25) traffic as the infected node participates in global spam runs, alongside DNS requests for highly entropic DGA domains. The impact of a Necurs infection is extreme; if left unmitigated, the botnet will rapidly download secondary, highly destructive payloads.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What was Necurs used for?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Sending massive spam campaigns that distributed ransomware and banking trojans."
      }
    },
    {
      "@type": "Question",
      "name": "What malware did Necurs help spread?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It distributed families such as Locky ransomware and Dridex, among others."
      }
    },
    {
      "@type": "Question",
      "name": "Was Necurs taken down?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, a coordinated takedown disrupted the Necurs botnet in 2020."
      }
    }
  ],
  "faq_count": 3,
  "mitre_attack": [
    "T1105",
    "T1562.001",
    "T1543.003",
    "T1014",
    "T1568.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1014",
      "name": "Rootkit",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1568.002",
      "name": "Dynamic Resolution: Domain Generation Algorithms",
      "tactic": "Command and Control"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Instantly sever the endpoint from the network to halt its participation in the spam botnet and prevent the download of secondary ransomware.",
    "Deploy global firewall rules to block outbound SMTP (Port 25) to prevent the infrastructure from being utilized for malspam.",
    "Perform offline memory analysis or boot from a Live CD to bypass the kernel-level rootkit and extract the malicious driver.",
    "Reimage the endpoint completely; relying on standard AV removal is futile as the Necurs rootkit actively spoofs file system queries."
  ],
  "what_to_avoid": [
    "Do not assume the endpoint is clean simply because the AV scan returns green; the Necurs rootkit intercepts AV scans and returns false data.",
    "Avoid leaving the machine running on the network during triage, as Necurs is known to push Locky ransomware as a secondary payload."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}