{
  "family": "nsismod",
  "sample_count": 55,
  "category": "ransomware",
  "description": "Trojan:Win32/Nsismod is a heuristic detection used by antivirus engines to flag malicious executables that have been packaged or wrapped using the Nullsoft Scriptable Install System (NSIS). While NSIS is a legitimate, open-source tool for creating Windows installers, threat actors heavily abuse it to bundle malware and evade detection.<br><br><b>Understanding Nsismod</b><br>To the user, this looks like a standard software installation wizard. For a malware analyst, an Nsismod detection is a red flag indicating a 'dropper' or 'bundler'. The threat actor writes an NSIS script that contains legitimate files (to trick the user and the AV) but also secretly extracts and executes a hidden malicious payload (like a RAT, adware, or ransomware) in the background. The detection implies the AV engine recognized the malicious NSIS script logic or identified a known malicious payload hidden within the installer archive.<br><br><b>Execution and Threat Hunting</b><br>Nsismod installers are typically distributed via drive-by downloads, fake software updates, or cracked software portals. Upon execution, the NSIS installer unpacks its contents to the `%Temp%` directory. The malicious NSIS script then executes the hidden payload (`T1204.002`). The evasion relies on the fact that AV engines often struggle to deeply scan custom-compiled installer archives in real-time. Threat hunters must utilize EDR to monitor the behavior of the installer process. If `setup.exe` (or similar) drops a secondary executable into `%Temp%` and immediately executes it, creating network connections or modifying the registry (`T1112`), an incident is likely underway.<br><br><b>Forensic Analysis & Impact</b><br>The impact depends entirely on the hidden payload. Incident responders cannot rely on the 'Nsismod' name for attribution. The immediate focus must be on extracting the contents of the NSIS installer. Analysts can use tools like `7-Zip` to crack open the installer archive, examine the `!include` scripts, and extract the true malicious binary for static and dynamic analysis.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1105",
    "T1112",
    "T1027.002",
    "T1204.002",
    "T1036.005"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File",
      "tactic": "Execution"
    },
    {
      "id": "T1027.002",
      "name": "Obfuscated Files or Information: Software Packing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1036.005",
      "name": "Masquerading: Match Legitimate Name or Location",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint if the Nsismod installer was executed; the heuristic detection means a potentially unknown payload was dropped.",
    "Extract the quarantined installer securely and use archive tools to open it and identify the true malicious payload hidden inside.",
    "Review EDR logs focusing on the child processes spawned by the installer executable to determine what was actually executed on the system.",
    "Determine the initial infection vector (e.g., where did the user download the fake installer from?) and block the source domain."
  ],
  "what_to_avoid": [
    "Do not assume the threat is minor because it's labeled as an installer; NSIS is frequently used to drop severe threats like ransomware or rootkits.",
    "Avoid closing the incident without identifying the true payload that the NSIS script was attempting to deploy."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}