2019-09-30 - Info from malspam pushing Shade ransomware

MALSPAM PUSHING SHADE (TROLDESH) RANSOMWARE ON MONDAY 2019-09-30

ASSOCIATED EMAIL:

- https://pastebin.com/Zn9hhmLv

INFECTION CHAIN:

- Email --> Attached PDF file --> link in PDF file --> downloaded zip archive --> Extracted JS file --> retrieves Shade (Troldesh) ransomware binary

URLS ASSOCIATED WITH THIS INFECTION CHAIN:

- hxxp://gigazine[.]us/wp-content/languages/plugins/doc/
- hxxps://www.blizzz[.]nl/wp-content/themes/vertikal/option-tree/assets/css/tF2Iu/2c.jpg
- hxxp://jonnyb[.]org/alexhampton/_assets/css/doc/2c.jpg

FILE HASHES ASSOCIATED WITH THIS INFECTION CHAIN:

- SHA256 hash: 3c504429569ca24a2e664471a8944d078a11be2fcefc122003b3134420909e00
- File size: 32,871 bytes
- File name: СДФ.pdf
- File description: PDF attachment from malspam pushing Shade (Troldesh) ransomware

- SHA256 hash: 4d262d0ce7fb86a346924b2415da0be61d7dd4f78c34e39496a5b1801e4582ca
- File size: 11,640 bytes
- File name: doc.zip
- File location: hxxp://gigazine[.]us/wp-content/languages/plugins/doc/
- File description: Zip archive downloaded from link in the above PDF file

- SHA256 hash: a53b461aa9872f58e30269429fe4765d52b8c14c7cda3af5812279e35a2f7f78
- File size: 17,751 bytes
- File name: Информация о заказе 26.09.2018-29.xls.js
- File description: Extracted JavaScript (.js) file extracted from the above zip archive.

- SHA256 hash: b648daf8cb29ad1cf72528d0e93a12c05f4752bd721173f035a5ee724fd97aa1
- File size: 178,8928 bytes
- File location: hxxps://www.blizzz[.]nl/wp-content/themes/vertikal/option-tree/assets/css/tF2Iu/2c.jpg
- File location: hxxp://jonnyb[.]org/alexhampton/_assets/css/doc/2c.jpg
- File location: C:\Users\[username]\AppData\Local\Temp\radAE6A6.tmp (various hex characters in file name)
- File description: Shade (Troldesh) ransomware binary (Windows EXE)