troldesh | 594888e65725142630834b674e4d80540aa7ed5b935d026ec748f70d386487f1 | Triage

Submit
Reports

Overview

overview

Static

static

594888e657...f1.exe

windows7-x64

594888e657...f1.exe

windows10-2004-x64

7

Sharing

General

Target

594888e65725142630834b674e4d80540aa7ed5b935d026ec748f70d386487f1
Size

911KB
Sample

220724-fd4aesfec8
MD5

83e96690ca13c315d47b19f602871ec0
SHA1

fed7470ecb0bc0669c5c515491ac5b300879dac4
SHA256

594888e65725142630834b674e4d80540aa7ed5b935d026ec748f70d386487f1
SHA512

b6ec5c20401c72232d2abbc4e08555cd50c175f2f3acdfed28878e287c1cf49528884a852308fb7522fcaba14bea2158337b1fc35cf4a7be3dfa573d12123c7b

Score

10^/10

troldesh persistence ransomware trojan upx

Static task

static1

Behavioral task

behavioral1

Sample

594888e65725142630834b674e4d80540aa7ed5b935d026ec748f70d386487f1.exe

Resource

win7-20220718-en

troldesh persistence ransomware trojan upx

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

594888e65725142630834b674e4d80540aa7ed5b935d026ec748f70d386487f1.exe

Resource

win10v2004-20220722-en

windows10-2004-x64

2 signatures

150 seconds

Malware Config

Targets

- Target
  
  594888e65725142630834b674e4d80540aa7ed5b935d026ec748f70d386487f1
- Size
  
  911KB
- MD5
  
  83e96690ca13c315d47b19f602871ec0
- SHA1
  
  fed7470ecb0bc0669c5c515491ac5b300879dac4
- SHA256
  
  594888e65725142630834b674e4d80540aa7ed5b935d026ec748f70d386487f1
- SHA512
  
  b6ec5c20401c72232d2abbc4e08555cd50c175f2f3acdfed28878e287c1cf49528884a852308fb7522fcaba14bea2158337b1fc35cf4a7be3dfa573d12123c7b
Score

10^/10

troldesh persistence ransomware trojan upx
- Troldesh, Shade, Encoder.858
  Troldesh is a ransomware spread by malspam.
  ransomware trojan troldesh
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

troldeshpersistenceransomwaretrojanupx

behavioral2

© 2018-2025

Terms | Privacy