JS/Nemucod.EBZ!tr

Analysis

JS/Nemucod.EBZ!tr is a generic detection for a trojan. Since this is a generic detection, malware that are detected as JS/Nemucod.EBZ!tr may have varying behaviour.
Below are some of its observed characteristics/behaviours:

• Create object ActiveXObject
• Create XMLHTTP object MSXML2.XMLHTTP
• Download file and save it to %temp% folder as rad8D041.tmp
• Write to file as Scripting.FileSystemObject or ADODB.Stream
• Run command cmd.exe to execute it
• The malware attempts to connect to the following sites:
  • hxxp://www.{Removed}ing.com/baise/mesg.jpg
  • hxxp://www.{Removed}xyz/mesg.jpg

Recommended Action

• Make sure that your FortiGate/FortiClient system is using the latest AV database.
• Quarantine/delete files that are detected and replace infected files with clean backup copies.