troldesh | 1e4b9f225ed46e67fdba49356d0aa837393f4c00b42bd84f7ffbba24c9810d6f | Triage

Submit
Reports

Overview

overview

Static

static

1e4b9f225e...le.exe

windows7_x64

1e4b9f225e...le.exe

windows10_x64

Sharing

General

Target

1e4b9f225ed46e67fdba49356d0aa837393f4c00b42bd84f7ffbba24c9810d6f.sample
Size

976KB
Sample

210726-64qs6bm4ye
MD5

fc2d1d2825c42a11b56d6e5fd0ef0317
SHA1

321680c5760d9dac5ad5c2c6c0cd1bc638a50b15
SHA256

1e4b9f225ed46e67fdba49356d0aa837393f4c00b42bd84f7ffbba24c9810d6f
SHA512

c70763ac0be9c9448d86a2c5ddfe2ecd8d392f312cbbdfc8fda39f3bc15500d68580c6c0698cb89578b8be54775a2d17f03edf1772c5a0481f4e35eaca798e21

Score

10^/10

troldesh discovery persistence ransomware spyware stealer trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

1e4b9f225ed46e67fdba49356d0aa837393f4c00b42bd84f7ffbba24c9810d6f.sample.exe

Resource

win7v20210408

troldesh discovery persistence ransomware spyware stealer trojan upx

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

1e4b9f225ed46e67fdba49356d0aa837393f4c00b42bd84f7ffbba24c9810d6f.sample.exe

Resource

win10v20210408

troldesh discovery persistence ransomware spyware stealer trojan upx

windows10_x64

0 signatures

0 seconds

Malware Config

Targets

- Target
  
  1e4b9f225ed46e67fdba49356d0aa837393f4c00b42bd84f7ffbba24c9810d6f.sample
- Size
  
  976KB
- MD5
  
  fc2d1d2825c42a11b56d6e5fd0ef0317
- SHA1
  
  321680c5760d9dac5ad5c2c6c0cd1bc638a50b15
- SHA256
  
  1e4b9f225ed46e67fdba49356d0aa837393f4c00b42bd84f7ffbba24c9810d6f
- SHA512
  
  c70763ac0be9c9448d86a2c5ddfe2ecd8d392f312cbbdfc8fda39f3bc15500d68580c6c0698cb89578b8be54775a2d17f03edf1772c5a0481f4e35eaca798e21
Score

10^/10

troldesh discovery persistence ransomware spyware stealer trojan upx
- Troldesh, Shade, Encoder.858
  Troldesh is a ransomware spread by malspam.
  ransomware trojan troldesh
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

troldeshdiscoverypersistenceransomwarespywarestealertrojanupx

behavioral2

troldeshdiscoverypersistenceransomwarespywarestealertrojanupx

© 2018-2024

Terms | Privacy