Overview

overview

10

Static

static

5013dc9e2d...83.exe

windows7_x64

10

5013dc9e2d...83.exe

windows10-2004_x64

1

Resubmissions

07-04-2024 03:03

240407-dkgnwsca25 10

07-04-2024 03:03

240407-dj9y2sbd8v 10

07-04-2024 03:03

240407-dj6avsbd71 10

07-04-2024 03:02

240407-djy7jsbd7s 10

01-02-2022 06:57

220201-hqya2sadfl 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5013dc9e2ddbe9ddd90af638466379f876b70ebe504d62e72ed166480a4d4f83

  • Size

    1.3MB

  • Sample

    220201-hqya2sadfl

  • MD5

    e2b8c884e9a91430ca6666f06aedf42e

  • SHA1

    805a1193f029840c1a2fc057942b72e5fb93dffd

  • SHA256

    5013dc9e2ddbe9ddd90af638466379f876b70ebe504d62e72ed166480a4d4f83

  • SHA512

    49922bd870dfb1296bc689e5abc8235f82d565db3a06544d6fc6974bf6611dfc73873018c4ebfb878d45633fb08565079b02a36e849e47809addb1bd2118aaad

Score
10/10
troldeshdiscoverypersistenceransomwaretrojanupx

Malware Config

Targets

    • Target

      5013dc9e2ddbe9ddd90af638466379f876b70ebe504d62e72ed166480a4d4f83

    • Size

      1.3MB

    • MD5

      e2b8c884e9a91430ca6666f06aedf42e

    • SHA1

      805a1193f029840c1a2fc057942b72e5fb93dffd

    • SHA256

      5013dc9e2ddbe9ddd90af638466379f876b70ebe504d62e72ed166480a4d4f83

    • SHA512

      49922bd870dfb1296bc689e5abc8235f82d565db3a06544d6fc6974bf6611dfc73873018c4ebfb878d45633fb08565079b02a36e849e47809addb1bd2118aaad

    Score
    10/10
    troldeshdiscoverypersistenceransomwaretrojanupx

    • Troldesh, Shade, Encoder.858

      Troldesh is a ransomware spread by malspam.

      ransomwaretrojantroldesh

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks