Overview

overview

10

Static

static

3549096a58...e9.exe

windows7_x64

10

3549096a58...e9.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3549096a585d730b37b964efb1cb3abdc1d43a77ed09ccdb4a48f4121983a2e9

  • Size

    1.1MB

  • Sample

    220619-wtbs4saea3

  • MD5

    75e0a3f7fa6853b006b7871be3217e21

  • SHA1

    df67a89d0af6227eb68faaee5e00e2e5560f9ea6

  • SHA256

    3549096a585d730b37b964efb1cb3abdc1d43a77ed09ccdb4a48f4121983a2e9

  • SHA512

    8c1a2ca4f64a40ea8bb3b52897560dab531bffc980b579deaf018a191fed271c792544c9fd6bf960cdf9e50825c375270a2466d87a1fa224be31afa44855af37

Score
10/10
troldeshdiscoverypersistenceransomwarespywarestealertrojanupx

Malware Config

Targets

    • Target

      3549096a585d730b37b964efb1cb3abdc1d43a77ed09ccdb4a48f4121983a2e9

    • Size

      1.1MB

    • MD5

      75e0a3f7fa6853b006b7871be3217e21

    • SHA1

      df67a89d0af6227eb68faaee5e00e2e5560f9ea6

    • SHA256

      3549096a585d730b37b964efb1cb3abdc1d43a77ed09ccdb4a48f4121983a2e9

    • SHA512

      8c1a2ca4f64a40ea8bb3b52897560dab531bffc980b579deaf018a191fed271c792544c9fd6bf960cdf9e50825c375270a2466d87a1fa224be31afa44855af37

    Score
    10/10
    troldeshdiscoverypersistenceransomwarespywarestealertrojanupx

    • Troldesh, Shade, Encoder.858

      Troldesh is a ransomware spread by malspam.

      ransomwaretrojantroldesh

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks