Threat actors behind Necurs rolling out new abilities on a monthly basis

guest · Jun 28, 2018

Threat actors behind Necurs rolling out new abilities on a monthly basis
June 28, 2018
https://www.scmagazine.com/threat-a...-abilities-on-a-monthly-basis/article/776870/

Trend Micro researchers Anita Hsieh, Rubio Wu, Kawabata Kohei noted a couple of new modules being inserted into Necurs, on pushing the XMRig cryptocurrency miner and the infostealers FlawedAmmyy RAT, AZORult, and a .NET module.

XMRig first appeared in March when it was shown to be able to mine Monero at the rate of about $1,200 per day, at least in one wallet studied by Trend Micro.

In April Necurs moved on to spread the remote access trojan FlawedAmmyy with its bots.
May saw Necurs move on to email extraction through modules that would attack Outlook accounts searching for that application's file containing email strings in the filenames and send those strings back to a website.

And starting in June Trend noticed the .NET spamming module being spread that is capable of stealing emails and credentials.
Click to expand...

Minimalist · Jul 30, 2018

New version of AZORult stealer improves loading features, spreads alongside ransomware in new campaign

AZORult is a robust information stealer & downloader that Proofpoint researchers originally identified in 2016 as part of a secondary infection via the Chthonic banking Trojan. We have since observed many instances of AZORult dropped via exploit kits and in fairly regular email campaigns as both a primary and secondary payload.

Recently, AZORult authors released a substantially updated version, improving both on its stealer and downloader functionality. It is noteworthy that within a day of the new update appearing on underground forums, a prolific actor used the new version in a large email campaign, leveraging its new capabilities to distribute Hermes ransomware. It is always interesting to see malware campaigns where both a stealer and ransomware are present, as this is less common [1], and especially disruptive for recipients who initially may have credentials, cryptocurrency wallets, and more stolen before losing access to their files in a subsequent ransomware attack.
Click to expand...

https://www.proofpoint.com/us/threa...r-improves-loading-features-spreads-alongside

Log in or Sign up

Threat actors behind Necurs rolling out new abilities on a monthly basis

guest Guest

Minimalist Registered Member

Log in or Sign up

Threat actors behind Necurs rolling out new abilities on a monthly basis

guest Guest

Minimalist Registered Member

Useful Searches