Trusted Design

JS/Nemucod

概要

JS/Nemucod is a JavaScript downloader trojan that targets users through malware spam campaigns. JS/Nemucod downloads additional malware and executes it without the user’s consent. JS/Nemucod usually arrives on an infected machine through malicious spam emails with .zip extensions. When a user opens the .zip file and double clicks the JavaScript, the default browser (Internet Explorer, Mozilla, etc.) opens and executes JavaScript.

Created: 2026-02-23

Indicators

• URL - http://fernytowd.com/80.exe -
• URL - http://firstwetakemanhat.com/69.exe -
• URL - http://firstwetakemanhat.com/91.exe -
• URL - http://ifyougowegotoo.com/90.exe -
• URL - http://whatdidyaysay.com/97.exe -
• URL - http://iamthewinnerhere.com/69.exe -
• URL - http://miracleworld1.com/80.exe -
• URL - http://washawaydesctrucion.com/90.exe -
• URL - http://areyouwevenlisten.com/89.exe -
• URL - http://fernytowd.com/73.exe -
• URL - http://areyouwevenlisten.com/69.exe -
• URL - http://beatifulgdf9dr.com/80.exe -
• URL - http://iamthewinnerhere.com/80.exe -
• URL - http://firstwetakemanhat.com/80.exe -
• URL - http://gammus.com/80.exe -
• URL - http://igonnafuckyougood.com/73.exe -
• URL - http://iamthewinnerhere.com/73.exe -
• URL - http://whatdidyaysay.com/73.exe -
• URL - http://igonnafuckyougood.com/80.exe -
• URL - http://fernytowd.com/69.exe -
• URL - http://whatdidyaysay.com/69.exe -
• URL - http://washawaydesctrucion.com/80.exe -
• URL - http://miracleworld1.com/69.exe -
• URL - http://areyouwevenlisten.com/80.exe -
• URL - http://whatdidyaysay.com/80.exe -
• URL - http://gammus.com/89.exe -
• URL - http://miracleworld1.com/91.exe -
• URL - http://fernytowd.com/89.exe -
• URL - http://igonnafuckyougood.com/89.exe -
• URL - http://iamthewinnerhere.com/97.exe -
• URL - http://ifyougowegotoo.com/80.exe -

類似Pulses

• Nemu malware on Metadefender.com (score: 0.65)
• Nemucod Evolves Delivery and Obfuscation Techniques to Harvest Credentials (score: 0.64)
• Malspam Mar 5 2018 (score: 0.54)
• JavaScript Redirecting to PUPs from WordPress (score: 0.54)
• MHT: Ransomware32 - The First JavaScript Ransomware (score: 0.52)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る