Nemucod Trojan Tries Again and Again to Infect Your System

You know the saying: “If at first you don’t succeed, try, try again.” The creators and propagators of the Nemucod trojan have taken that to heart. They’ve been hard at working making it even harder for anti-malware programs to detect.

Nemucod is actually a malware downloader that is designed in such lightweight way that it does not attract attention from anyone or anything and can go about its business downloading the actual malware that does the damage. These include backdoor trojans, banking trojans, ransomware, and the like. The improvements have made it such that if one of its methods to complete its tasks does not work, it will move on to another one until it finally succeeds. Earlier versions would just quit when it failed.

It’s important to keep anti-malware installed on all systems and keep it updated. It’s not enough to just install it once and think that is sufficient. Malware continues to evolve and each time, it tends to get stealthier and that alone makes it more dangerous. So if you want to keep your private information private, this is one step that can help.

In addition, make sure all your software and apps are updated with the latest security and critical patches and versions. Most have the option to auto-update and if you have a hard time finding the time or remembering to do this, click that option to the “on” position. If you do this, you won’t have to rely on your memory or a break in a busy schedule to keep your devices at a lower risk of infection or your information safer.

According to experts a security company ESET, the creators of Nemucod have given it a list of seven steps in order to download the final payload, regardless of whether it is Locky, Cerber, or something else. The steps are roughly the following:

1. It selects a way to connect to its command and control servers that host the second-state, more damaging malware. If one method is blocked by security measures such as firewalls, it may try another way to reach the download locations.
2. It selects a random download site from a list, whereas before it only had one choice and would be useless if that failed.
3. It downloads the payload file, which is obfuscated and then sort of reverse engineers it to get it to work.
4. It has a second debofuscation round and then performs a validity check of the file it downloaded. If it fails, it starts back at step two and tries again.
5. It tries a third deobfuscation and then finally executes its payload.

It just won’t quit. So take some time to secure your devices, learn how to avoid phishing attacks, and you have a much higher chance to keep Nemucod and others like it out of your systems.