{"id":31827,"date":"2019-08-21T03:55:00","date_gmt":"2019-08-21T07:55:00","guid":{"rendered":"http:\/\/blog.cybercon1.com\/?p=31827"},"modified":"2019-08-21T03:55:00","modified_gmt":"2019-08-21T07:55:00","slug":"troldesh-ransomware-dropper","status":"publish","type":"post","link":"https:\/\/www.cyberconservices.com\/index.php\/2019\/08\/21\/troldesh-ransomware-dropper\/","title":{"rendered":"Troldesh Ransomware Dropper"},"content":{"rendered":"\n

By Luke Leal\u00a0<\/a>– Over the past few weeks, we\u2019ve seen an increase in Troldesh ransomware <\/strong>using compromised websites as intermediary malware distributors.<\/p>\n\n\n\n

The malware often uses a PHP file that acts as a delivery tool for downloading the host\u00a0malware dropper<\/a>: This type of infected URL is usually spread through malicious emails or through services like social media. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Once a victim clicks the URL and loads it, a JScript<\/a> file downloads to the victim\u2019s computer. This malware targets Windows OS, which uses JScript: .\/\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u043a\u0430\u0437\u0430 \u041e\u0410\u041e \u0410\u0432\u0438\u0430\u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u0423\u0440\u0430\u043b\u044c\u0441\u043a\u0438\u0435 \u0430\u0432\u0438\u0430\u043b\u0438\u043d\u0438\u0438.js<\/em><\/p>\n\n\n\n

The JScript filename is written in Russian and translates to \u201cDetails of the order of JSC Airline Ural Airlines\u201d, indicating that attackers may have been attempting to spoof this airline company to trick victims. Read On:<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

By Luke Leal\u00a0– Over the past few weeks, we\u2019ve seen an increase in Troldesh ransomware using compromised websites as intermediary malware distributors. The malware often uses a PHP file that acts as a delivery tool for downloading the host\u00a0malware dropper: This type of infected URL is usually spread through malicious emails or through services like […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[636],"tags":[637],"class_list":["post-31827","post","type-post","status-publish","format-standard","hentry","category-ransomware","tag-ransomware"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t