JS/Nemucod.DAG!tr.dldr

Analysis

JS/Nemucod.DAG!tr.dldr is a generic detection for a downloader trojan. At the time of analysis, this malware managed to download a ransomware from the following URL:

• hxxp://{Removed}wokia.top/admin.php?f=404

The file is saved to the local host as undefinedAppDataundefined\Microsoft\Windows\Templates\[Random].exe and is detected as W32/GenKryptik.AGWR!tr.

Recommended Action

• Make sure that your FortiGate/FortiClient system is using the latest AV database.
• Quarantine/delete files that are detected and replace infected files with clean backup copies.