NecursMalware
- nucurs
Last reported 3 years ago, by Elastic Security Labs1 report
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1005Data from Local System
“Data from Local System”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Dynamic API Resolution”
- T1027.007Dynamic API Resolution
“Dynamic API resolution”
- T1033System Owner/User Discovery
“System Owner/User Discovery”
- T1041Exfiltration Over C2 Channel
“Exfiltration Over C2 Channel”
- T1176.001Browser Extensions
“After the browser extensions are enumerated, there is a check for a hardcoded file titled hmr_*.dat inside the C:\ProgramData directory.”
What the reports say
1 report, newest first · the exact sentence from each-
Elastic Security Labs discovers the LOBSHOT malware“TA505 is a well-known cybercrime group associated with Dridex, Locky, and Necurs campaigns.”
Indicators in its reports
named in the reports above- hxxps://www.amydecke[.]websitein 1 report
- www.amydecke[.]websitein 1 report
- e4ea88887753a936…e27991856bf6in 1 report
- 95.217.125[.]200in 1 report
- hxxps://malpedia.caad.fkie.fraunhofer[.]de/actor/ta505in 1 report
- hxxps://www.malware-traffic-analysis[.]net/2023/01/23/index.htmlin 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.