troldesh | 1f55ed37f443441f832854493f3b658cd955e0abcc855e45bc950c80224c3b67

General

Target

gorilla-tag-monke
Size

156KB
Sample

240418-rynw1sfg99
MD5

c90731af4650b56d9e83b9b3628b1017
SHA1

0793b17f8c0376261c75a042f81757d64860d56c
SHA256

1f55ed37f443441f832854493f3b658cd955e0abcc855e45bc950c80224c3b67
SHA512

67f1b66dd2729f7ec88bee53b7c80b6323354a42f1f2bbb79a03d2652d5f8232f906994d6df2a981cdf894d493ad8e8ab967c20f66be621d4c08e666bd83bdd3
SSDEEP

1536:BUvTJMcdX5G8oz66l3gT3eWr2Y+NXdBAC7ho9kLfnYXTlGykh3u9kV/tWGzjy0EY:EJTzeLgERGKt0csjFh1+6Di

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Extracted

Path

C:\Users\Admin\Downloads\r.wry

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send %s to this bitcoin address: %s Next, please find the decrypt software on your desktop, an executable file named "%s". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) %s rar password: wcry123 Run and follow the instructions!

Targets

- Target
  
  gorilla-tag-monke
- Size
  
  156KB
- MD5
  
  c90731af4650b56d9e83b9b3628b1017
- SHA1
  
  0793b17f8c0376261c75a042f81757d64860d56c
- SHA256
  
  1f55ed37f443441f832854493f3b658cd955e0abcc855e45bc950c80224c3b67
- SHA512
  
  67f1b66dd2729f7ec88bee53b7c80b6323354a42f1f2bbb79a03d2652d5f8232f906994d6df2a981cdf894d493ad8e8ab967c20f66be621d4c08e666bd83bdd3
- SSDEEP
  
  1536:BUvTJMcdX5G8oz66l3gT3eWr2Y+NXdBAC7ho9kLfnYXTlGykh3u9kV/tWGzjy0EY:EJTzeLgERGKt0csjFh1+6Di
Score

10^/10

troldesh wannacry aspackv2 persistence ransomware spyware stealer trojan upx worm
- Troldesh, Shade, Encoder.858
  Troldesh is a ransomware spread by malspam.
  ransomware trojan troldesh
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Downloads MZ/PE file
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Drops startup file
- Executes dropped EXE
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Sets desktop wallpaper using registry
  ransomware
behavioral1