troldesh | 556385396b3383b85bc2e2e9fdf1c3bc8801d4665aae745b0120a4ac4d95aaa0 | Triage

Submit
Reports

Overview

overview

Static

static

1

556385396b...a0.exe

windows7-x64

556385396b...a0.exe

windows10-2004-x64

Sharing

General

Target

556385396b3383b85bc2e2e9fdf1c3bc8801d4665aae745b0120a4ac4d95aaa0
Size

940KB
Sample

220725-tnelpshgaq
MD5

c729b5dd77e6dafba527e578aa1c222d
SHA1

f3b589aa4553aefa0138bd793d2cb5a0f0bf967d
SHA256

556385396b3383b85bc2e2e9fdf1c3bc8801d4665aae745b0120a4ac4d95aaa0
SHA512

5b7e318ea2203e56ff5b4d4ab9023813be76602a6d739563b5b6cab7ff487145c8bc075799b34971471891651debbcb00f8bf3ef2a67b841ee586b01b9f7c382

Score

10^/10

troldesh persistence ransomware trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

556385396b3383b85bc2e2e9fdf1c3bc8801d4665aae745b0120a4ac4d95aaa0.exe

Resource

win7-20220718-en

troldesh persistence ransomware trojan upx

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

556385396b3383b85bc2e2e9fdf1c3bc8801d4665aae745b0120a4ac4d95aaa0.exe

Resource

win10v2004-20220721-en

troldesh persistence ransomware trojan upx

windows10-2004-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  556385396b3383b85bc2e2e9fdf1c3bc8801d4665aae745b0120a4ac4d95aaa0
- Size
  
  940KB
- MD5
  
  c729b5dd77e6dafba527e578aa1c222d
- SHA1
  
  f3b589aa4553aefa0138bd793d2cb5a0f0bf967d
- SHA256
  
  556385396b3383b85bc2e2e9fdf1c3bc8801d4665aae745b0120a4ac4d95aaa0
- SHA512
  
  5b7e318ea2203e56ff5b4d4ab9023813be76602a6d739563b5b6cab7ff487145c8bc075799b34971471891651debbcb00f8bf3ef2a67b841ee586b01b9f7c382
Score

10^/10

troldesh persistence ransomware trojan upx
- Troldesh, Shade, Encoder.858
  Troldesh is a ransomware spread by malspam.
  ransomware trojan troldesh
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

troldeshpersistenceransomwaretrojanupx

behavioral2

troldeshpersistenceransomwaretrojanupx

© 2018-2025

Terms | Privacy