Necurs – hybrid spam botnet

This report presents a technical analysis of the Necurs botnet, a large-scale spam-distributing botnet that uses a hybrid centralized and P2P command-and-control architecture, a domain generation algorithm, encrypted resources and custom protocols to deliver payloads (notably the Locky ransomware). It documents Necurs's C2 and P2P message formats, resource structures, anti-analysis measures, the spam-sending DLL JSON format, and provides sample hashes and YARA rules to aid detection and response.