Loading malware…
Necro is a malware name used for two distinct families, but the most widely recognized current usage refers to an Android Trojan/dropper active in trojanized applications distributed both through official and third-party channels. On Android, Necro is a multi-component malware platform that can download and install additional malicious payloads, display intrusive advertising through hidden or invisible windows, and monetize infections through unauthorized paid-service subscriptions. Recent reporting indicates broad exposure through infected popular apps and game modifications, with heavy use of obfuscation and steganographic concealment to evade analysis and detection.
Necro has also been used as the name of an older Python-based botnet family associated with the Keksec ecosystem. That earlier family was first identified in 2015, initially targeted Windows, and later evolved into Linux-focused variants. It used IRC-based command and control, propagated through brute-force activity and rapid exploitation of newly disclosed vulnerabilities, and supported capabilities including distributed denial-of-service attacks, traffic sniffing, cryptocurrency mining payload delivery, process hiding on Windows via a user-mode rootkit, and web-file infection to inject malicious JavaScript. It has been linked to Keksec alongside other botnet families such as Gafgyt, Tsunami, LOLFME, and EnemyBot.
Because the Android Necro and the Python botnet Necro share the same name but differ substantially in platform and behavior, analysts should disambiguate by context. In contemporary mobile-threat usage, Necro most commonly denotes the Android Trojan/dropper rather than the older cross-platform botnet family.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
9 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The three more popular exploits integrated by Necro can be seen in Figures 9–11... 1. TerraMaster RCE: CVE-2020-28188 | The year-long attack campaign can be divided into two phases; high-frequency attacks are maintained until December 2020, and resumed in January 2021, when Keksec starts spreading the brand new malware family Necro.
2021.1.8 CVE-2021-3007 2021.1.3 Zend Framework Necro | The year-long attack campaign can be divided into two phases; high-frequency attacks are maintained until December 2020, and resumed in January 2021, when Keksec starts spreading the brand new malware family Necro.
The three more popular exploits integrated by Necro can be seen in Figures 9–11... 3. WebLogic RCE: CVE-2020-14882 | The year-long attack campaign can be divided into two phases; high-frequency attacks are maintained until December 2020, and resumed in January 2021, when Keksec starts spreading the brand new malware family Necro.
2021.3.20 CVE-2021-21972 2021.2.27 VMware_vCenterServer Necro | The year-long attack campaign can be divided into two phases; high-frequency attacks are maintained until December 2020, and resumed in January 2021, when Keksec starts spreading the brand new malware family Necro.
2021.1.8 CVE-2020-35665 2020.12.23 TerraMaster Necro | The year-long attack campaign can be divided into two phases; high-frequency attacks are maintained until December 2020, and resumed in January 2021, when Keksec starts spreading the brand new malware family Necro.
2021.1.8 CVE-2020-7961 2020.7 Liferay Portal Necro | The year-long attack campaign can be divided into two phases; high-frequency attacks are maintained until December 2020, and resumed in January 2021, when Keksec starts spreading the brand new malware family Necro.
Earlier versions of Necro exploited the following vulnerabilities in web applications: ... Laravel RCE (CVE-2021-3129) ... | A newly discovered malware campaign utilizing the Necro Python bot shows this actor is adding new functionality and improving its chances of infecting vulnerable systems.
The version released on May 18 also included Python versions of EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0147) exploits with a Windows download command line as the payload. | A newly discovered malware campaign utilizing the Necro Python bot shows this actor is adding new functionality and improving its chances of infecting vulnerable systems.
The version released on May 18 also included Python versions of EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0147) exploits with a Windows download command line as the payload. | A newly discovered malware campaign utilizing the Necro Python bot shows this actor is adding new functionality and improving its chances of infecting vulnerable systems.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The year-long attack campaign can be divided into two phases; high-frequency attacks are maintained until December 2020, and resumed in January 2021, when Keksec starts spreading the brand new malware family Necro.
34 distinct techniques documented for this family, organized by ATT&CK tactic.
We can see that Keksec launched scans and attacks on targets across the network almost non-stop. Our honeypots see new variants and exploits all the time, with the exception of some occasional breaks. When a new exploit is introduced, the scans increase significantly.
Once an IP address is generated, the bot will connect to a list of ports and attempt to spread either by using a hardcoded list of SSH credentials and issuing a remote command if a login attempt is successful.
Necro’s goal in infecting web files is to spread JS Bot (Cloud9). The bot is loaded when the user accesses an infected page through a browser.
Keksec attacks the target device mainly through exploits, so the network-wide vulnerability scan is its main means of spreading malicious samples... Comparing the point in time when the new exploit was added and the POC exposure time we can see that Keksec’s utilization of 1-days is very fast.
Persistence is ensured by modifying the /etc/rc.local script to include commands to launch the bot when the system is booted.
Necro first downloads the corresponding version of the rootkit file, which is dynamically loaded and run directly in memory by process injection... Necro uses process injection to load the rootkit by wrapping the dll file into a shellcode and then injecting the whole shellcode into the process memory.
The open-source project r77 rootkit is used directly on Windows systems. It is a ring3 layer rootkit that intercepts and filters information about the target process by globally hooking some functions of ntdll.dll.
Most of the Gafgyt and Tsunami samples we captured were not packed... String encoding... Necro also cryptographically protects the string by first performing character substitution and then doing zip compression.
A very traditional technique on Linux systems is to use random strings to override argv parameters and prctl(PR_SET_NAME,buf) to change the process name and start parameters in order to disguise the process.
Necro first downloads the corresponding version of the rootkit file, which is dynamically loaded and run directly in memory by process injection... Necro uses process injection to load the rootkit by wrapping the dll file into a shellcode and then injecting the whole shellcode into the process memory.
Packet sniffing is one of the more favoured features of Keksec, and the code can be seen in all three families. The basic function is to capture TCP traffic after filtering out some specified ports and IPs, and to send the remaining data to the C2.
Apart from installing miner code, the JavaScript-based bot contains additional functionality to accept commands from the C2 server and it may be used to steal data from the clipboard, by logging keystrokes and launching DoS attacks.
The scanners used by Keksec are mainly telnet and SSH weak password scan and exploit scan.
Keksec’s malware mainly uses Gafgyt and IRC protocols to send commands.
The IRC protocol is the most widely used protocol in Keksec, and is supported by the Tsunami, Necro and DarkIRC families.
We found Tor proxy being used to communicate with the C2 in both Gafgyt and Necro.
Download — Download a file from a supplied URL Execute — First, download, then execute, the downloaded file Update — Update with a new bot version Dlexe — Download and execute a file
The first algorithm is a purely random one that picks 16 characters at random from a custom alphabet to generate a C2 domain name with the top-level domain ‘xyz’... The second algorithm is based on the DDNS service, and the random algorithm picks 10 to 19 characters randomly from a custom alphabet.
Keksec also contains the popular mining function, which is not deeply integrated in the bot but directly implemented by releasing a third-party miner program.
Keksec is trying to make profit from DDoS, mining, stealing user information and selling malware. Through long-term tracking we can see that DDoS attack activity is the most prominent
86 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Only mentioned as a related headline; no functional details provided in the analyzed content.
Only mentioned as a related headline; no functional details provided in the analyzed content.
Android dropper distributed via trojanized apps/mods (including on Google Play) that uses obfuscation and steganography to conceal payloads; monetizes via invisible ad interactions and paid subscription fraud; can download additional malware.
KekSec-developed botnet mentioned as background context.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.