troldesh | 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02

Resubmissions

17/04/2024, 14:30

240417-rt43faca4910

17/04/2024, 14:30

17/04/2024, 14:29

17/04/2024, 14:29

17/04/2024, 14:29

31/07/2022, 05:21

Sharing

Copy URL Twitter E-mail

General

Target
94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02
Size 1.5MB
Sample240417-rt4fxade5v
SHA256 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02
MD5 6599f79e40a26186261b58aa89194e5b
SHA1 0a44b71f930447d545de0f10b6f9c70d513acacc
SHA512 9e4c8b704bdf6f69df693c40c323f069ac7b9900ab8486d7e5a8423670aa1ee686ccfb6c4026f903d0928145efeee04b0b4cded0000f918862208baba9913748
SSDEEP 24576:4i9CFkYBMSUkGUbDkAv0f3BIykhWmRkLhKRahLo1ChjllyzD8k20ZItIhi4Gx:4ieMSU0bD7Q3Bfkh9k1VtKChpIzD/Std
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02
- Size 1.5MB
- SHA256 94b88650ebf3fe56877d27316b51a4ddf27b4182892b167b5b03b35d84c95d02
- MD5 6599f79e40a26186261b58aa89194e5b
- SHA1 0a44b71f930447d545de0f10b6f9c70d513acacc
- SHA512 9e4c8b704bdf6f69df693c40c323f069ac7b9900ab8486d7e5a8423670aa1ee686ccfb6c4026f903d0928145efeee04b0b4cded0000f918862208baba9913748
- SSDEEP 24576:4i9CFkYBMSUkGUbDkAv0f3BIykhWmRkLhKRahLo1ChjllyzD8k20ZItIhi4Gx:4ieMSU0bD7Q3Bfkh9k1VtKChpIzD/Std
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

troldesh discovery persistence ransomware spyware stealer trojan upx
- Troldesh, Shade, Encoder.858
  Troldesh is a ransomware spread by malspam.
  ransomware trojan troldesh
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies Installed Components in the registry
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of SetThreadContext
behavioral1 behavioral2 behavioral3 behavioral4 behavioral5