Skip to content
MalwareWiki

Malware

NACHOCHEESE

aka Cyruslish · TWOPENCE · VIVACIOUSGIFT

According to FireEye, NACHOCHEESE is a command-line tunneler that accepts delimited C&C IPs or domains via command-line and gives actors shell access to a victim's system.

NACHOCHEESE, also known as Cyruslish, TWOPENCE, VIVACIOUSGIFT, is a Windows malware family operated by Lazarus Group.

Background

FireEye describes NACHOCHEESE as a command-line tunneler that takes delimited C&C IPs or domains as command-line arguments and grants operators shell access to a victim's machine.

Source: Malpedia (Fraunhofer FKIE).