Netskope Threat Labs

Nemucod

ATP Sandbox Adv. HeuristicsAVNetskope IPS

Nemucod is a JavaScript downloader that arrives through spam email attachments and has previously delivered TeslaCrypt and other ransomware families. The script fetches additional payloads from remote servers, and its small footprint let it slip past defenses focused on executable attachments. Although the families it once delivered have faded, the downloader remains a template for script based malware distribution that persists in modern campaigns.

First seen
January 2022
Last seen
October 2026
Alert Name
Document-HTML.Downloader.Nemucod
Document-PDF.Downloader.Nemucod
Document-Word.Downloader.Nemucod
Email-MIME.Downloader.Nemucod
Email-MSG.Downloader.Nemucod
Email.Downloader.Nemucod
Generic.JS.Nemucod.1.1776FEFE
Generic.JS.Nemucod.1.CE288F48
GT:JS.Downloader.Nemucod.1.15D91173
GT:JS.Downloader.Nemucod.1.64320433