General
- Target 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02
- Size 1.5MB
- Sample240417-rt4fxade5v
- SHA256 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02
Score
10/10
Malware Config
Targets
-
- Target 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02
- Size 1.5MB
- SHA256 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02
Score10/10Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Modifies Installed Components in the registry
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
Adds Run key to start application
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Sets desktop wallpaper using registry
Suspicious use of SetThreadContext