A PHP file is often the delivery mechanism for downloading the malware dropper. The JScript link used in the attack is written in Russian. Translated, the file name is “Details of the order of JSC Airline Ural Airlines”, possibly in an attempt by the hackers to convince potential victims that the link is legitimate. If clicked by the victim, the JScript begins downloading the executable, which is pulled from compromised websites. Once the malware begins its encryption process, one key is used to encrypt the file name and another key is used to encrypt the contents of the file. While encrypting, Troldesh also pulls data about the system and sends it back to its command and control servers. The README.txt file left behind contains instructions on how to contact the attackers for payment and the decryption method. If the victim is unable to make contact via email, a TOR .onion URL is also provided.
Details of the order of JSC Airline Ural Airlines
Malware Hash (MD5/SHA1/SH256)