troldesh | 9748374c9b8025b43fe1e8dee646b80525bd98f795f5722106487adfa2a9d0aa

General

Target

ransomware.zip
Size

2.7MB
Sample

240508-dbkzyshc75
MD5

55c6d1601d19c258df09ef6552d1163e
SHA1

0561e738811b2d1bcaeb49fe7e1758f59a2843bf
SHA256

9748374c9b8025b43fe1e8dee646b80525bd98f795f5722106487adfa2a9d0aa
SHA512

37c2a2b486b9716833162f319322122fde7ae78add09c636388b7f3dfb5196caa7af090bdc52ed3690c0c6649c6f0cc1c7533dac5fdfbbed4c5258bc2d453143
SSDEEP

49152:khSSmaVW2zNin6NVp+Ob6gHhSSmaVW2zNin6NVp+Ob6gFhSSmaVW2zNin6NVp+OL:k8XbegPOb6K8XbegPOb6g8XbegPOb6i

Score

10^/10

Malware Config

Targets

- Target
  
  csrss.bin
- Size
  
  1.2MB
- MD5
  
  16a313d609f999958dbeb95cd4cf2ccf
- SHA1
  
  a012954a7257eaea94b4d21ca9c8997fefebade4
- SHA256
  
  3c1cf2acf484d12b8ce39d8f9881313d4ba7d3fb5977163881a9089c2c1b2b97
- SHA512
  
  d9cddf49804604b15178a64df8814e903948d7ca3ccc415e75946bfe11109817e72fcff4f21edb01b2f0b3e651cf20e94fda5f2930a5deaf17893ac5a97fce8c
- SSDEEP
  
  24576:/xQDBHwbrk6VC+bz1CTACJS/jxJxFhv4TFvE9vZXqXsP:/x5bR1MqxXFh4TdEVdqw
Score

10^/10

troldesh discovery persistence ransomware spyware stealer trojan upx
- Troldesh, Shade, Encoder.858
  Troldesh is a ransomware spread by malspam.
  ransomware trojan troldesh
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  
  msg[1].jpg
- Size
  
  1.2MB
- MD5
  
  16a313d609f999958dbeb95cd4cf2ccf
- SHA1
  
  a012954a7257eaea94b4d21ca9c8997fefebade4
- SHA256
  
  3c1cf2acf484d12b8ce39d8f9881313d4ba7d3fb5977163881a9089c2c1b2b97
- SHA512
  
  d9cddf49804604b15178a64df8814e903948d7ca3ccc415e75946bfe11109817e72fcff4f21edb01b2f0b3e651cf20e94fda5f2930a5deaf17893ac5a97fce8c
- SSDEEP
  
  24576:/xQDBHwbrk6VC+bz1CTACJS/jxJxFhv4TFvE9vZXqXsP:/x5bR1MqxXFh4TdEVdqw
Score

10^/10

troldesh discovery persistence ransomware spyware stealer trojan upx
- Troldesh, Shade, Encoder.858
  Troldesh is a ransomware spread by malspam.
  ransomware trojan troldesh
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral3 behavioral4
- Target
  
  rad1903E.tmp
- Size
  
  1.2MB
- MD5
  
  16a313d609f999958dbeb95cd4cf2ccf
- SHA1
  
  a012954a7257eaea94b4d21ca9c8997fefebade4
- SHA256
  
  3c1cf2acf484d12b8ce39d8f9881313d4ba7d3fb5977163881a9089c2c1b2b97
- SHA512
  
  d9cddf49804604b15178a64df8814e903948d7ca3ccc415e75946bfe11109817e72fcff4f21edb01b2f0b3e651cf20e94fda5f2930a5deaf17893ac5a97fce8c
- SSDEEP
  
  24576:/xQDBHwbrk6VC+bz1CTACJS/jxJxFhv4TFvE9vZXqXsP:/x5bR1MqxXFh4TdEVdqw
Score

10^/10

troldesh discovery persistence ransomware spyware stealer trojan upx
- Troldesh, Shade, Encoder.858
  Troldesh is a ransomware spread by malspam.
  ransomware trojan troldesh
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral5 behavioral6