MALWARE FAMILY

N3Cr0m0rPh

Internal ID: py.n3cr0m0rph

aliases

Last seen:Mar 17, 2026

Intelligence Profile

An IRC bot written in (obfuscated) Python code. Distributed in attack campaign FreakOut, written by author Freak/Fl0urite and development potentially dating back as far as 2015.

Threat Analysis

N3Cr0m0rPh is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/

→https://blog.netlab.360.com/necro-upgrades-again-using-tor-dynamic-domain-dga-and-aiming-at-both-windows-linux/

→https://blog.netlab.360.com/necro/

→https://blog.netlab.360.com/not-really-new-pyhton-ddos-bot-n3cr0m0rph-necromorph/

→https://blog.talosintelligence.com/2021/06/necro-python-bot-adds-new-tricks.html

→https://blogs.juniper.net/en-us/threat-research/necro-python-botnet-goes-after-vulnerable-visualtools-dvr

→https://github.com/lacework/lacework-labs/tree/master/keksec

→https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/

→https://twitter.com/xuy1202/status/1392089568384454657

→https://twitter.com/xuy1202/status/1393384128456794116

Quick Facts

TypeMalware Family

Aliases1

Also Known As

py.n3cr0m0rph

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search N3Cr0m0rPh