✕

Rewterz Annual Threat Intelligence Report 2025 - Download Now

Request a Demo
Rewterz

Rewterz Threat Alert – Remcos RAT Delivered via Phishing Campaign

August 19, 2019
Rewterz

Rewterz Threat Alert – Fake Tax Calculator Installs xRAT

August 20, 2019

Rewterz Threat Alert – Troldesh Ransomware Dropped via PHP Files

Severity

High

Analysis Summary

A PHP file is often the delivery mechanism for downloading the malware dropper. The JScript link used in the attack is written in Russian. Translated, the file name is “Details of the order of JSC Airline Ural Airlines”, possibly in an attempt by the hackers to convince potential victims that the link is legitimate. If clicked by the victim, the JScript begins downloading the executable, which is pulled from compromised websites. Once the malware begins its encryption process, one key is used to encrypt the file name and another key is used to encrypt the contents of the file. While encrypting, Troldesh also pulls data about the system and sends it back to its command and control servers. The README.txt file left behind contains instructions on how to contact the attackers for payment and the decryption method. If the victim is unable to make contact via email, a TOR .onion URL is also provided.

Impact

File encryption

Indicators of Compromise

Filename

Details of the order of JSC Airline Ural Airlines

Malware Hash (MD5/SHA1/SH256)

  • 43d78a497d4fc7a500e33d09bda1b93097727c703b7a0ed698bda3b417efd7c4
  • 3d4d462dbc7dbfd12af693f8176e9fd6814560ed763448fa75fa6dad026567f4

Remediation

  • Block all threat indicators at your respective controls.
  • Always be suspicious about emails sent by unknown senders.
  • Never click on the links/attachments sent by unknown senders.

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo