Overview

overview

10

Static

static

3

3c0fe521f6...16.exe

windows7-x64

10

3c0fe521f6...16.exe

windows10-1703-x64

10

3c0fe521f6...16.exe

windows10-2004-x64

10

3c0fe521f6...16.exe

windows11-21h2-x64

10

Resubmissions

18-03-2024 13:43

240318-q1nhlaag4w 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816

  • Size

    947KB

  • Sample

    240414-my5sbaba4v

  • MD5

    39217b125403ff7c755622ef9bbef974

  • SHA1

    9fc607b7c17919c83999bdd119e9cd6bf413101a

  • SHA256

    3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816

  • SHA512

    1252ea94931eaf4426ca1eb94a070645238775c447a09286109fe894c569de29ca502882a0fa34e97e09109c43c486a3aa32081e3a3afef0b6557db59c71fc50

  • SSDEEP

    12288:3+Zn/gJtKaNIBpB+iMMOD30ZnZ47m0T3JF9j3GOF0l7B2FzqL2aZa7rf58bs:3+RYeaNILZi/JDLG60y1aZvs

Score
10/10
troldeshpersistenceransomwaretrojanupx

Malware Config

Targets

    • Target

      3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816

    • Size

      947KB

    • MD5

      39217b125403ff7c755622ef9bbef974

    • SHA1

      9fc607b7c17919c83999bdd119e9cd6bf413101a

    • SHA256

      3c0fe521f6a9cfbfabc1f27a1a64dfc081a63aaaf2a6ce8cd831f6251ee85816

    • SHA512

      1252ea94931eaf4426ca1eb94a070645238775c447a09286109fe894c569de29ca502882a0fa34e97e09109c43c486a3aa32081e3a3afef0b6557db59c71fc50

    • SSDEEP

      12288:3+Zn/gJtKaNIBpB+iMMOD30ZnZ47m0T3JF9j3GOF0l7B2FzqL2aZa7rf58bs:3+RYeaNILZi/JDLG60y1aZvs

    Score
    10/10
    troldeshpersistenceransomwaretrojanupx

    • Troldesh, Shade, Encoder.858

      Troldesh is a ransomware spread by malspam.

      ransomwaretrojantroldesh

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks