Necurs

Aliases: nucurs

First seen
2012-01-01 00:00:00
Malware type
botnet
Family
Malware family
Last IoC activity
2026-07-22 03:38:51
Profile updated
2026-07-07 12:40:33

Targeted industries: financial-services technology-and-telecommunications retail-and-hospitality

Context

Necurs is a notorious malware family primarily known for its capabilities as a spam botnet. It facilitates the distribution of other malware, including ransomware and banking trojans, making it a significant threat in the cybercriminal ecosystem.

Detection coverage

  • 1 YARA rules

Detection rules

  • MALPEDIA_Win_Necurs_Auto (yara-rule)

Reports & references

  • CrowdStrike — Report2020Crowdstrikeglobalthreatreport (report)
  • proofpoint.com — Holiday Lull Not So Much (report)
  • secureworks.com — Gold Riverview (report)
  • cert.ssi.gouv.fr — Certfr 2020 Cti 008 (report)
  • blog.intel471.com — A Brief History Of Ta505 (report)
  • intel471.com — A Brief History Of Ta505 (report)
  • shadowserver.org — Has The Sun Set On The Necurs Botnet (report)
  • lokalhost.pl — Peering.Into.Spam.Botnets.Virusbulletin2017 (report)
  • research.nccgroup.com — Tracking A P2P Network Related With Ta505 (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Necurs (report)
  • bin.re — The Dgas Of Necurs (report)
  • trustwave.com — Necurs Recurs (report)
  • bitsighttech.com — Necurs Proxy Module With Ddos Features (report)
  • blog.avast.com — Botception With Necurs Botnet Distributes Script With Bot Capabilities Avast Threat Labs (report)
  • Trend Micro — The New Face Of Necurs Noteworthy Changes To Necurs Behaviors (report)
  • Microsoft — Necurs Botnet Cyber Crime Disrupt (report)
  • cert.pl — Necurs Hybrid Spam Botnet (report)
  • blueliv.com — Blueliv Necurs Report 2017 (report)
  • Trend Micro — Necurs Evolves To Evade Spam Detection Via Internet Shortcut File (report)
  • Cisco Talos — Necurs Diversifies (report)
  • bitsight.com — Joint Effort With Microsoft To Takedown Massive Criminal Botnet Necurs (report)
  • cofense.com — Necurs Targeting Banks Pub File Drops Flawedammyy (report)
  • secureworks.com — Gold Riverview (report)

External references