Researchers at security firm Symantec said the new functionality included the ability to take screenshots and mail them back to a remote location.
There was also an error-reporting capability that reported back any errors that were encountered by the downloader as it tried to do what it was programmed to do.
A typical invoice email sent by the Necurs botnet.
The new rash of emails from Necurs use the tried and trusted method of social engineering with a fake invoice as the lure.
But that apart, the downloader also executed a PowerShell script that made a screenshot and saved it as generalpd.jpg. After this was saved, it was uploaded to a remote server.
"Much like crash reports in OSes can help software companies fix issues and build better products, these error reports can help attackers spot problems in the field and address them to improve success rates. After all, you can’t count on the victims to report back errors and issues!" researchers Eduardo Altares, Wei Wang Dai, and Mingwei Zhang wrote.
Symantec telemetry shows Necurs emails with script attachments have grown fourfold since June.
The researchers said the best way to avoid getting caught by one of these emails was to:
- Delete any suspicious-looking emails you receive, especially if they contain links or attachments;
- Always keep your security software up-to-date to protect yourself against any new variants of malware;
- Keep your operating system and other software updated. Software updates will frequently include patches for newly discovered security vulnerabilities that could be exploited by attackers; and
- Regularly back up any files stored on your computer. If your computer does become infected with ransomware, your files can be restored once the malware has been removed.
Cover graphic: courtesy Microsoft. Article-level graphics: courtesy Symantec