troldesh | 03246cda354d8efbc9e22057cc283609825f15cf33ddc5296deac54c2b540218 | Triage

Sharing

General

Target

03246cda354d8efbc9e22057cc283609825f15cf33ddc5296deac54c2b540218
Size

1.1MB
Sample

200326-vdx964rn9a
MD5

32126de1466136e0b4f39560f3956fb9
SHA1

1f2b679904a40552d24d430529e70c916504aef4
SHA256

03246cda354d8efbc9e22057cc283609825f15cf33ddc5296deac54c2b540218
SHA512

50b49d35e8953584e1dc3a9263093ef1be4f75ac6daec1eb18d649ff9228d819166aa0949f9f0f336354ce10ad7f5a71295b1704b86f311c0e3afebbbc9905ec

Score

10^/10

troldesh discovery persistence ransomware trojan

Malware Config

Targets

- Target
  
  03246cda354d8efbc9e22057cc283609825f15cf33ddc5296deac54c2b540218
- Size
  
  1.1MB
- MD5
  
  32126de1466136e0b4f39560f3956fb9
- SHA1
  
  1f2b679904a40552d24d430529e70c916504aef4
- SHA256
  
  03246cda354d8efbc9e22057cc283609825f15cf33ddc5296deac54c2b540218
- SHA512
  
  50b49d35e8953584e1dc3a9263093ef1be4f75ac6daec1eb18d649ff9228d819166aa0949f9f0f336354ce10ad7f5a71295b1704b86f311c0e3afebbbc9905ec
Score

10^/10

discovery persistence ransomware trojan troldesh
- Troldesh,Shade,Encoder.858
  Troldesh is a ransomware spread by malspam.
  ransomware trojan troldesh
- Adds Run entry to start application
  persistence
- Checks for installed software on the system
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistenceransomwaretrojantroldesh

behavioral2