Malware

Nemucod

Nemucod is a Windows JavaScript-based malware downloader primarily distributed through high-volume malicious email campaigns. Common lures impersonate invoices or other business correspondence and use archive attachments containing heavily obfuscated JavaScript. When a recipient executes the script through Windows Script Host, Nemucod retrieves and launches additional payloads from remote infrastructure. Observed payloads include TeslaCrypt, Locky, Dridex, Emotet, and other malware families. Nemucod campaigns use JavaScript obfuscation, including randomized variables and encoded download locations, to hinder inspection and evade email-security controls. It was particularly prominent in global malspam activity during 2015–2017.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence3

The banker is distributed through malicious email spam campaigns that carry an attachment of a heavily obfuscated JavaScript downloader from a family commonly known as Nemucod.

T1566.001Spearphishing AttachmentEvidence2

Posing as a fake invoice, they try to convince the users into opening an attached ZIP file.

Execution

3 techniques

T1059.007JavaScriptEvidence2

Instead of finding an EXE file, the ZIP container has a Javascript file inside. This technique might have been used by the attackers to avoid detection in some mail scanners and reach as many victims as possible.

T1204User ExecutionEvidence2

It comes with the classic instruction to double-click on the image to see it fully. As expected, doing so executes a malicious javascript

T1204.002Malicious FileEvidence1

Attached to the document is a javascript with a small thumbnail of what the recipient is intended to assume is their cable bill.

Stealth

1 technique

T1027Obfuscated Files or InformationEvidence2

One is that most of the variables used seems to be using random names. Also, we found two arrays in the code that could be a way of obfuscating the IPs or web addresses used by these criminals to spread the malware.

Defense Impairment

1 technique

T1553.004Install Root CertificateEvidence1

The malicious JavaScript begins to install a fake SSL Certificate

Credential Access

1 technique

T1557Adversary-in-the-MiddleEvidence1

This is a very common setup for man-in-the-middle (MITM) attacks. By setting the browser proxies, the attacker can lead users to phishing pages

Collection

1 technique

T1557Adversary-in-the-MiddleEvidence1

This is a very common setup for man-in-the-middle (MITM) attacks. By setting the browser proxies, the attacker can lead users to phishing pages

Command and Control

2 techniques

T1090.001Internal ProxyEvidence1

The malicious JavaScript begins to install a fake SSL Certificate, and sets proxies on IE, Chrome, and Mozilla browsers to a remote Proxy Auto Config (PAC) file.

T1105Ingress Tool TransferEvidence3

the script then downloads a RAT server

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app7 years ago

ACTIVITY FEED

Recent activity

11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

11 SOURCESView more in app

cymulate blogNews

Mar 17, 2026

Threat Intelligence Analyst & Malware Researcher Guide

A ransomware family suggested by an automated ransom-note attribution service, but not supported by the author; the note was subsequently linked to Rever ransomware.

trendmicro comNews

Jan 1, 2025

Search - Threat Encyclopedia | Trend Micro (US)

Spam-delivered downloader trojan that retrieves additional payloads including Locky ransomware and Dridex.

g data software blogNews

Jun 15, 2021

Naming malware: Why this jumbled mess is our own fault

A named loader mentioned as an example of a malware family name derived by reversing a string found in infrastructure or artifacts.

trend micro blog historicNews

Aug 5, 2019

Trickbot Delivered via Highly Obfuscated JS File | Trend Micro (US)

Referenced in detection naming for the dropped JavaScript file used in the infection chain as a downloader/dropper component.

+7 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Nemucod