Rewterz Threat Alert – Troldesh Ransomware Dropped via PHP Files

Severity

High

Analysis Summary

A PHP file is often the delivery mechanism for downloading the malware dropper. The JScript link used in the attack is written in Russian. Translated, the file name is “Details of the order of JSC Airline Ural Airlines”, possibly in an attempt by the hackers to convince potential victims that the link is legitimate. If clicked by the victim, the JScript begins downloading the executable, which is pulled from compromised websites. Once the malware begins its encryption process, one key is used to encrypt the file name and another key is used to encrypt the contents of the file. While encrypting, Troldesh also pulls data about the system and sends it back to its command and control servers. The README.txt file left behind contains instructions on how to contact the attackers for payment and the decryption method. If the victim is unable to make contact via email, a TOR .onion URL is also provided.

Impact

File encryption

Indicators of Compromise

Filename

Details of the order of JSC Airline Ural Airlines

Malware Hash (MD5/SHA1/SH256)

• 43d78a497d4fc7a500e33d09bda1b93097727c703b7a0ed698bda3b417efd7c4
• 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent by unknown senders.
• Never click on the links/attachments sent by unknown senders.