Overview

overview

10

Static

static

2e88e60123...59.exe

windows7_x64

10

2e88e60123...59.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2e88e60123f0d285a09e079326d295dc28cac76e222a3f3ad96038b31ca1ea59

  • Size

    961KB

  • Sample

    220622-j5vddabchm

  • MD5

    e697d27432d8b3b691328b765c8bf9e3

  • SHA1

    b631af4bc744a902a88adacb9d9361c9318dbeb9

  • SHA256

    2e88e60123f0d285a09e079326d295dc28cac76e222a3f3ad96038b31ca1ea59

  • SHA512

    bcba531de5106b0b6b8418dc822fc51253aab1e89647e9095c6beb3f440298e3e2c972404b505020c6248ba10cdb6943c48257a013ed30b2ac9b3eb059c5ba0b

Score
10/10
troldeshdiscoverypersistenceransomwarespywarestealertrojanupx

Malware Config

Targets

    • Target

      2e88e60123f0d285a09e079326d295dc28cac76e222a3f3ad96038b31ca1ea59

    • Size

      961KB

    • MD5

      e697d27432d8b3b691328b765c8bf9e3

    • SHA1

      b631af4bc744a902a88adacb9d9361c9318dbeb9

    • SHA256

      2e88e60123f0d285a09e079326d295dc28cac76e222a3f3ad96038b31ca1ea59

    • SHA512

      bcba531de5106b0b6b8418dc822fc51253aab1e89647e9095c6beb3f440298e3e2c972404b505020c6248ba10cdb6943c48257a013ed30b2ac9b3eb059c5ba0b

    Score
    10/10
    troldeshdiscoverypersistenceransomwaretrojanupxspywarestealer

    • Troldesh, Shade, Encoder.858

      Troldesh is a ransomware spread by malspam.

      ransomwaretrojantroldesh

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks