{
  "family": "nsismod",
  "sample_count": 55,
  "category": "trojan_downloader",
  "description": "Nsismod (cataloged by security vendors as PUA.Win32.NSISMod and Trojan:Win32/Nsismod) represents trojanized and modified Nullsoft Scriptable Install System (NSIS) installers active since 2015. Threat actors unpack legitimate open-source freeware, patch the NSIS configuration scripts, and repackage the archives with hidden payloads, malicious browser extensions, and adware stagers. When users run the deceptive setup executable, Nsismod installs the expected legitimate utility while silently dropping and executing secondary adware, proxyware, or infostealer payloads in the background.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "PUA.Win32.NSISMod",
    "Trojan:Win32/Nsismod",
    "Adware.NSISMod",
    "PUA:Win32/Nsismod",
    "Trojan-Dropper.Win32.NSISMod"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Nsismod?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Nsismod refers to modified NSIS software installers that bundle hidden malware or adware alongside legitimate applications."
      }
    },
    {
      "@type": "Question",
      "name": "How do attackers weaponize NSIS installers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Attackers unpack legitimate installers, alter the setup scripts to drop malware silently, and recompile the executable."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads are typically delivered by Nsismod?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It frequently drops adware, browser hijackers, crypto-miners, infostealers, or proxyware services."
      }
    },
    {
      "@type": "Question",
      "name": "Is Nsismod ever a false positive?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Legitimate freeware packaging sponsored offers in NSIS can trigger PUA flags, but third-party repacks are high risk."
      }
    },
    {
      "@type": "Question",
      "name": "How can organizations protect against trojanized installers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Download software exclusively from verified vendor websites, verify digital signatures, and enforce application whitelisting."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1027.002",
    "T1105",
    "T1547.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2015,
  "threat_actor": null,
  "delivery_mechanism": [
    "Repackaged Freeware & Open Source Installers",
    "Torrent & File Sharing Downloads",
    "Deceptive Search Engine Ad Results"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Silent Secondary Binary Extraction",
    "Dual-Purpose Installation (Payload + Cover App)",
    "System Information Profiling",
    "Registry Autostart Configuration",
    "Digital Signature Tampering"
  ],
  "technical_analysis": {
    "file_types": [
      "NSIS Installer Executable (Win32 PE)",
      "Self-Extracting Archive"
    ],
    "network_signatures": [
      "HTTP GET requests downloading secondary setup stages from untrusted hosting servers"
    ],
    "evasion_techniques": [
      "Bundling inside legitimate, functional software to deceive end users",
      "Extracting payloads into temporary subdirectories before silent execution"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "8194ad9271649275819385920a19e48b3b42f2b3",
      "57291dc8f781bb49f8b15df726489312bcf8194a"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\NsismodUpdate"
    ],
    "file_paths": [
      "%Temp%\\nsis_extracted\\payload.exe",
      "%AppData%\\nsismod\\helper.dll"
    ]
  },
  "defensive_measures": [
    "Validate Authenticode digital signatures on all downloaded installers prior to execution",
    "Enforce AppLocker or Windows Defender Application Control (WDAC) policies",
    "Enable Potentially Unwanted Application (PUA) protection across all endpoints"
  ],
  "sources": [
    {
      "name": "Trend Micro Threat Encyclopedia - PUA.Win32.NSISMod",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/pua.win32.nsismod"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "PUA.Win32.NSISMod.A",
      "Trojan:Win32/Nsismod!rfn"
    ]
  },
  "motivation": "Pay-Per-Install Monetization & Silent Malware Staging",
  "sample_hashes": []
}