{
  "family": "nemucod",
  "sample_count": 1,
  "category": "ransomware",
  "description": "TrojanDownloader:JS/Nemucod (or VBS/Nemucod) is one of the most prolific and historically significant malware downloaders. Primarily distributed via massive spam campaigns, Nemucod arrives as a tiny, heavily obfuscated JavaScript (`.js`) or VBScript (`.vbs`) file hidden inside a ZIP archive. Its sole purpose is to execute via the Windows Script Host (`wscript.exe`), silently connect to a compromised website, and download a catastrophic secondary payload—most famously, ransomware families like Locky, Cerber, or TeslaCrypt (`T1105`).<br><br><b>Understanding Nemucod (Script Downloaders)</b><br>To an end-user, they receive a fake invoice or shipping notification, extract the ZIP, double-click the seemingly harmless file, and see nothing happen. Minutes later, their files are encrypted. For a security team, Nemucod represents the danger of allowing script execution from user directories. It is an 'Initial Access Broker' that paves the way for total data loss.<br><br><b>Execution and Dropper Mechanics</b><br>The infection chain relies on social engineering (`T1566.001`) to trick the user into extracting and running the script. Because Windows associates `.js` and `.vbs` files with `wscript.exe` by default, double-clicking them executes the code (`T1059.007`). The script itself is heavily obfuscated (using string concatenation, random variables, and encoding) to evade static email filters (`T1027`). Once running, it uses COM objects (like `MSXML2.XMLHTTP`) to download the secondary payload (usually an `.exe` or a `.dll`) to the `%Temp%` folder, and then executes it.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is almost always a severe secondary infection (Ransomware or Banking Trojans). Host-based IoCs include EDR alerts for `wscript.exe` or `cscript.exe` executing from within zip archives or `%Temp%` directories, and `wscript.exe` spawning unexpected child processes (like `cmd.exe` or dropping unknown executables). Network IoCs involve the `wscript.exe` process making outbound HTTP GET requests to compromised WordPress sites or unknown domains to fetch the payload.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1105",
    "T1566.001",
    "T1059.007",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1059.007",
      "name": "Command and Scripting Interpreter: JavaScript/JScript (Executing the obfuscated downloader payload via WScript)",
      "tactic": "Execution"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Downloading the secondary payload, such as Locky ransomware)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment (Primary distribution method via ZIP files)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information (Heavy obfuscation of the script to bypass email gateways)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint *immediately*; if Nemucod has executed, a ransomware payload is likely actively encrypting files.",
    "Use EDR to trace the execution chain: locate the original spam email, the extracted script, and the domains it contacted.",
    "Block the identified payload delivery domains at the corporate firewall to prevent other users who received the spam from downloading the ransomware.",
    "Change the default Windows file association for `.js` and `.vbs` files to open with Notepad instead of `wscript.exe` via Group Policy (GPO)."
  ],
  "what_to_avoid": [
    "Do not allow `wscript.exe` to execute scripts originating from `%Temp%` or `%Downloads%` directories without strict application control.",
    "Avoid relying solely on email attachment scanning, as the obfuscated scripts are often designed to bypass static signature checks."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}