Data by Hatching Triage Windows

Nemucod

Nemucod is a Windows JavaScript-based malware downloader primarily distributed through high-volume malicious email campaigns.

Profile source: Mallory

Nemucod

Family profile

Nemucod is a Windows JavaScript-based malware downloader primarily distributed through high-volume malicious email campaigns. Common lures impersonate invoices or other business correspondence and use archive attachments containing heavily obfuscated JavaScript. When a recipient executes the script through Windows Script Host, Nemucod retrieves and launches additional payloads from remote infrastructure. Observed payloads include TeslaCrypt, Locky, Dridex, Emotet, and other malware families. Nemucod campaigns use JavaScript obfuscation, including randomized variables and encoded download locations, to hinder inspection and evade email-security controls. It was particularly prominent in global malspam activity during 2015–2017.

Capabilities

Defense Evasion

MITRE ATT&CK

Nemucod in ATT&CK

10 distinct techniques

Techniques

10 techniques

T1566.001 Spearphishing Attachment T1027 Obfuscated Files or Information T1566 Phishing T1204.002 Malicious File T1105 Ingress Tool Transfer T1059.007 JavaScript T1557 Adversary-in-the-Middle T1204 User Execution T1553.004 Install Root Certificate T1090.001 Internal Proxy

Reporting

Research mentioning Nemucod

Jan 1

Cert Polska

Backswap malware analysis | CERT Polska

Researchers detailed BackSwap, a banking trojan linked to the TinBa malware family, that targeted online banking users by hiding inside trojanized legitimate Windows applications such as 7-Zip, FileZilla, and Notepad++. First observed in 2018, the malware focused on Polish banks and later shifted heavily toward Spanish financial institutions, while also occasionally targeting cryptocurrency wallet users. Its operators used compromised legitimate websites as command-and-control infrastructure and repeatedly changed encryption keys, payload storage, and exfiltration methods to evade detection. BackSwap stood out for avoiding classic browser memory injection and instead manipulating browser sessions through Windows UI monitoring and simulated user actions. It delivered malicious JavaScript into active banking sessions, stole credentials, logged browser window titles and URLs, hijacked clipboard data, and replaced recipient account numbers to redirect transactions to attacker-controlled IBANs. Analysts said the malware stored XOR-obfuscated or encrypted web-injects in the .rsrc section, sometimes concealed shellcode in BMP images, and used position-independent code plus custom Windows API resolution to reduce its forensic footprint and bypass antivirus heuristics.

Nov 30

Checkpoint Research

Nemucod malware spreads ransomware Teslacrypt

TeslaCrypt emerged as a fast-moving ransomware family that encrypted both common user documents and game-related files, including saved games and Steam-related data, expanding its impact to PC gamers. Initial infections were linked to malicious email attachments and exploit kits such as Angler, which abused browser and plugin flaws including Adobe Flash CVE-2015-0311; later distribution was also tied to Sweet Orange and Nuclear via compromised websites. The malware deleted Volume Shadow Copies, contacted command-and-control infrastructure, and used ransom notes and recovery files to pressure victims into paying in Bitcoin. Later TeslaCrypt variants significantly hardened their cryptography and extortion workflow. Researchers reported that early versions falsely claimed to use RSA-2048 while actually relying on AES-CBC-256, with key material stored locally in files such as key.dat, allowing decryption in some cases and enabling Cisco Talos to release a recovery utility when the necessary keys were present. TeslaCrypt 2.0, however, adopted a stronger design using ECDH over secp256k1 with AES-256-CBC, moved key-related data into the Windows registry, generated unique Bitcoin addresses per victim, appended the .zzz extension to encrypted files, and replaced its interface with an HTML ransom page modeled on CryptoWall, making recovery without attacker-controlled key material far more difficult.

Oct 9

Paloalto Researchcenter Historic