JS/Nemucod.DTD!tr.dldr

Analysis

JS/Nemucod.DTD!tr.dldr is a generic detection for a JS Downloader Trojan that installs Locky Ransomware, detected as W32/Locky.AZKQ!tr.ransom. Since this is a generic detection, this malware may have varying behaviour.
Along with W32/Locky.AZKQ!tr.ransom, below are some of the observed characteristics/behaviours for this infection:

• This malicious JS may download from any of the remote site listed below, then usually saves it as undefinedTempundefined\[Random].exe, afterwhich executes it.
  
  • ind{Removed}.info/admin.php?a=1
  The dropped file is currently detected as W32/Locky.AZKQ!tr.ransom.


• Below is an illustrations of the dropped Ransomware notes:
  

  Figure 1: Ransom note.

  
  

Recommended Action

• Make sure that your FortiGate/FortiClient system is using the latest AV database.
• Quarantine/delete files that are detected and replace infected files with clean backup copies.