Overview

overview

10

Static

static

3

1cc8df75fa...18.exe

windows7-x64

10

1cc8df75fa...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1cc8df75face9909e22176b7e882a3a5_JaffaCakes118

  • Size

    1.6MB

  • Sample

    240506-q36f7add6y

  • MD5

    1cc8df75face9909e22176b7e882a3a5

  • SHA1

    a016b71d6ca86801f493bd4fb82029e048ee581a

  • SHA256

    7ae414b81771ec569467c710c4c0d420c19299d908ba283e130f071b4a09c479

  • SHA512

    fd741c41aecdfc25a11982db86ba977955a55574657f99db638cda8725387fad215e9fbf2eb6b20c8746b7b9d55b2b9be65534f1655ea4cd53e96fed24d9ed1f

  • SSDEEP

    24576:osbr/NEr59dSTr3bXsZkBVsMYey2qbJInd6vLSfAiaHJ/tOhl278IK:tREr5jSXIKBvY52qbJIUv2GJ/Eh08I

Score
10/10
troldeshdiscoverypersistenceransomwarespywarestealertrojanupx

Malware Config

Targets

    • Target

      1cc8df75face9909e22176b7e882a3a5_JaffaCakes118

    • Size

      1.6MB

    • MD5

      1cc8df75face9909e22176b7e882a3a5

    • SHA1

      a016b71d6ca86801f493bd4fb82029e048ee581a

    • SHA256

      7ae414b81771ec569467c710c4c0d420c19299d908ba283e130f071b4a09c479

    • SHA512

      fd741c41aecdfc25a11982db86ba977955a55574657f99db638cda8725387fad215e9fbf2eb6b20c8746b7b9d55b2b9be65534f1655ea4cd53e96fed24d9ed1f

    • SSDEEP

      24576:osbr/NEr59dSTr3bXsZkBVsMYey2qbJInd6vLSfAiaHJ/tOhl278IK:tREr5jSXIKBvY52qbJIUv2GJ/Eh08I

    Score
    10/10
    troldeshdiscoverypersistenceransomwarespywarestealertrojanupx

    • Troldesh, Shade, Encoder.858

      Troldesh is a ransomware spread by malspam.

      ransomwaretrojantroldesh

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks