Malware families evolve on a daily basis, but some updates catch your eye more than others. Necurs has just gone through one of these "interesting" updates, according to US security firm Symantec.
Before we go on, we must explain that Necurs is a name given to both a malware strain and the botnet of infected computers it creates.
In the world of security research, the Necurs malware strain is a "downloader" or "loader," and just like similar downloaders, it only has three major functions: (1) gain boot persistence on an infected PC, (2) collect telemetry on infected hosts, and (3) download and install a second-stage payload.
The Necurs malware is distributed via spam sent by Necurs bots or hacked web servers. When you read news stories about "the Necurs botnet spreading the Locky ransomware," it's actually "the Necurs botnet spreading the Necurs downloader, which then installs the Locky ransomware."
