Overview

overview

10

Static

static

4748eb93e8...59.exe

windows7_x64

10

4748eb93e8...59.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4748eb93e8bf41f68800bca52f31b31e8f67f186ff9d2f7e7ab01b5a9f298059

  • Size

    1.3MB

  • Sample

    220714-h1cr4aegb6

  • MD5

    05c18c388bebea2b3f2463b2a5932b71

  • SHA1

    1335834224d275bdccfcd0921bb22221e14bda9d

  • SHA256

    4748eb93e8bf41f68800bca52f31b31e8f67f186ff9d2f7e7ab01b5a9f298059

  • SHA512

    924762181560c1fa214aab5c9eb1d42dcaae5f30241b1232333821e25c78ec06b5c4cc3f56df0ef83a8159c7d8966252b61f0beeaace899dcea6d1bb82a79792

Score
10/10
troldeshdiscoverypersistenceransomwarespywarestealertrojanupx

Malware Config

Targets

    • Target

      4748eb93e8bf41f68800bca52f31b31e8f67f186ff9d2f7e7ab01b5a9f298059

    • Size

      1.3MB

    • MD5

      05c18c388bebea2b3f2463b2a5932b71

    • SHA1

      1335834224d275bdccfcd0921bb22221e14bda9d

    • SHA256

      4748eb93e8bf41f68800bca52f31b31e8f67f186ff9d2f7e7ab01b5a9f298059

    • SHA512

      924762181560c1fa214aab5c9eb1d42dcaae5f30241b1232333821e25c78ec06b5c4cc3f56df0ef83a8159c7d8966252b61f0beeaace899dcea6d1bb82a79792

    Score
    10/10
    troldeshdiscoverypersistenceransomwarespywarestealertrojanupx

    • Troldesh, Shade, Encoder.858

      Troldesh is a ransomware spread by malspam.

      ransomwaretrojantroldesh

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks