troldesh | 53e3bb561c54df00565fba06ddf477f9980e734e543c85103d8c073cb13a5107

Resubmissions

07/04/2024, 06:19

240407-g267nafd5210

07/04/2024, 06:18

07/04/2024, 06:17

07/04/2024, 03:06

06/03/2022, 02:16

Sharing

Copy URL Twitter E-mail

General

Target
53e3bb561c54df00565fba06ddf477f9980e734e543c85103d8c073cb13a5107
Size 1.4MB
Sample240407-g267nafd52
SHA256 53e3bb561c54df00565fba06ddf477f9980e734e543c85103d8c073cb13a5107
MD5 0bb5679dae9b16d3926be4b2c8c596d7
SHA1 f0d68b1798913c37b3c19970262e3d0e63558232
SHA512 31ac1246975c6d432a1751997a83e2fec5fb91ba538915be08d67a5db385adb22d994f1d19ebb1374e0bad07accf7b1b892f5f68a6e6cbb0e71cc08479fff4ee
SSDEEP 12288:GBpIwAR/kkMD/thCtMybHDYmCTO8f9QdQ0qqA28tHbgPXv5uT8rsOJLnM27GZe/:G7Iw8cjhSHDY3XQ2WzC7guYrNJDM26y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  53e3bb561c54df00565fba06ddf477f9980e734e543c85103d8c073cb13a5107
- Size 1.4MB
- SHA256 53e3bb561c54df00565fba06ddf477f9980e734e543c85103d8c073cb13a5107
- MD5 0bb5679dae9b16d3926be4b2c8c596d7
- SHA1 f0d68b1798913c37b3c19970262e3d0e63558232
- SHA512 31ac1246975c6d432a1751997a83e2fec5fb91ba538915be08d67a5db385adb22d994f1d19ebb1374e0bad07accf7b1b892f5f68a6e6cbb0e71cc08479fff4ee
- SSDEEP 12288:GBpIwAR/kkMD/thCtMybHDYmCTO8f9QdQ0qqA28tHbgPXv5uT8rsOJLnM27GZe/:G7Iw8cjhSHDY3XQ2WzC7guYrNJDM26y
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

troldesh discovery persistence ransomware spyware stealer trojan upx
- Troldesh, Shade, Encoder.858
  Troldesh is a ransomware spread by malspam.
  ransomware trojan troldesh
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies Installed Components in the registry
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1