Overview

overview

10

Static

static

b5fa77609e...25.exe

windows7-x64

10

b5fa77609e...25.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b5fa77609effa05423d0ba2e9629a86ab57e05a7860fa711cb99ef61c6ce8525

  • Size

    1014KB

  • Sample

    220731-krb6bahhep

  • MD5

    67941d7c81021f970a6d501f0ec3b81a

  • SHA1

    5b819927857a393d1b81c53af6e4740522b4b10a

  • SHA256

    b5fa77609effa05423d0ba2e9629a86ab57e05a7860fa711cb99ef61c6ce8525

  • SHA512

    3999d285d41ee0948d5599a8435d27880e39e1379cab1cd40de091a294be02af57b41dadec024796cd6be8b3baee27ad323e926e8589b777fc1d52a30736aae4

Score
10/10
troldeshdiscoverypersistenceransomwaretrojanupx

Malware Config

Targets

    • Target

      b5fa77609effa05423d0ba2e9629a86ab57e05a7860fa711cb99ef61c6ce8525

    • Size

      1014KB

    • MD5

      67941d7c81021f970a6d501f0ec3b81a

    • SHA1

      5b819927857a393d1b81c53af6e4740522b4b10a

    • SHA256

      b5fa77609effa05423d0ba2e9629a86ab57e05a7860fa711cb99ef61c6ce8525

    • SHA512

      3999d285d41ee0948d5599a8435d27880e39e1379cab1cd40de091a294be02af57b41dadec024796cd6be8b3baee27ad323e926e8589b777fc1d52a30736aae4

    Score
    10/10
    troldeshdiscoverypersistenceransomwaretrojanupx

    • Troldesh, Shade, Encoder.858

      Troldesh is a ransomware spread by malspam.

      ransomwaretrojantroldesh

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks