Overview

overview

10

Static

static

6556303d76...32.exe

windows7-x64

10

6556303d76...32.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6556303d76c57a172c38ce49630acbceb6b5fb9f033a9ff0c3d1ad5668269c32

  • Size

    1012KB

  • Sample

    220731-jv4jasfdc9

  • MD5

    e99a6653e12d6b676a8984380b387a15

  • SHA1

    3c17b6a7e1f0d3be71cfa185d8866f7caccbeb46

  • SHA256

    6556303d76c57a172c38ce49630acbceb6b5fb9f033a9ff0c3d1ad5668269c32

  • SHA512

    e908819771ba6eabb61433c65763593eb941554f677784657f4409cc51c7c342542e02bc2fe54caff9e3f3044ea993d29abfef499723a68222ed37cba1227941

Score
10/10
troldeshdiscoverypersistenceransomwaretrojanupx

Malware Config

Targets

    • Target

      6556303d76c57a172c38ce49630acbceb6b5fb9f033a9ff0c3d1ad5668269c32

    • Size

      1012KB

    • MD5

      e99a6653e12d6b676a8984380b387a15

    • SHA1

      3c17b6a7e1f0d3be71cfa185d8866f7caccbeb46

    • SHA256

      6556303d76c57a172c38ce49630acbceb6b5fb9f033a9ff0c3d1ad5668269c32

    • SHA512

      e908819771ba6eabb61433c65763593eb941554f677784657f4409cc51c7c342542e02bc2fe54caff9e3f3044ea993d29abfef499723a68222ed37cba1227941

    Score
    10/10
    troldeshdiscoverypersistenceransomwaretrojanupx

    • Troldesh, Shade, Encoder.858

      Troldesh is a ransomware spread by malspam.

      ransomwaretrojantroldesh

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks