troldesh | 9f76bdf33649d6e035eddd507a6d6826283ef450a3055320806ce3053523a2aa

Sharing

Copy URL

Twitter E-mail

General

Target

62a3384531a6f4d2c74980833b8f01c0_JaffaCakes118
Size

940KB
Sample

240521-j8t7saec94
MD5

62a3384531a6f4d2c74980833b8f01c0
SHA1

98fbbb1b64e627b7eb312469a89b221ba2be07ae
SHA256

9f76bdf33649d6e035eddd507a6d6826283ef450a3055320806ce3053523a2aa
SHA512

d789bfc8dd7436fc0f4c5912cc71d546e8230f3ac51ca3e226154e05f7f3b2a4e43b91249080f031d6cd2b6d8215bb3b68de617bf0dcd569142c856fda568675
SSDEEP

24576:Mrx+v0kJ7zGWSuGMuJov3rsM7ok8XWv2bz09Wvfr1Yoz:m+v0kB6WLGMu+zsM7ok8XWv2vuWHC8

Score

10^/10

Malware Config

Targets

- Target
  
  62a3384531a6f4d2c74980833b8f01c0_JaffaCakes118
- Size
  
  940KB
- MD5
  
  62a3384531a6f4d2c74980833b8f01c0
- SHA1
  
  98fbbb1b64e627b7eb312469a89b221ba2be07ae
- SHA256
  
  9f76bdf33649d6e035eddd507a6d6826283ef450a3055320806ce3053523a2aa
- SHA512
  
  d789bfc8dd7436fc0f4c5912cc71d546e8230f3ac51ca3e226154e05f7f3b2a4e43b91249080f031d6cd2b6d8215bb3b68de617bf0dcd569142c856fda568675
- SSDEEP
  
  24576:Mrx+v0kJ7zGWSuGMuJov3rsM7ok8XWv2bz09Wvfr1Yoz:m+v0kB6WLGMu+zsM7ok8XWv2vuWHC8
Score

10^/10

troldesh discovery persistence ransomware spyware stealer trojan upx
- Troldesh, Shade, Encoder.858
  Troldesh is a ransomware spread by malspam.
  ransomware trojan troldesh
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/StartMenu.dll
- Size
  
  7KB
- MD5
  
  12281b59f907027f4d374b8423e2b0f9
- SHA1
  
  21216630633bb6cc4aa9b1c5873f345bbe06b74c
- SHA256
  
  1cc68f4aef76d70d7326853f0e604ff3ac926c1dfe7aee7ad69a3259280a4e66
- SHA512
  
  7c8c7a5c7f8e6d7a0b5d54ad1bfc34831358487985bd64459cd22f45f82385f4740e7a62048b01759b79e3d0f05ccb8152d63c3d864f308146ce5c746a9296b6
- SSDEEP
  
  96:qgiqVPb3X8K8Kdr3gEq6nNdMk6Qiw290+q6LDtJ1tR3hhEl7y:qgiqVPgK8K9eIdE9B/tVhg7
Score

3^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  3f176d1ee13b0d7d6bd92e1c7a0b9bae
- SHA1
  
  fe582246792774c2c9dd15639ffa0aca90d6fd0b
- SHA256
  
  fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
- SHA512
  
  0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
- SSDEEP
  
  192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/nsExec.dll
- Size
  
  6KB
- MD5
  
  b5a1f9dc73e2944a388a61411bdd8c70
- SHA1
  
  dc9b20df3f3810c2e81a0c54dea385704ba8bef7
- SHA256
  
  288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
- SHA512
  
  b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
- SSDEEP
  
  96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
Score

3^/10
behavioral7 behavioral8
- Target
  
  Uninstall.exe
- Size
  
  54KB
- MD5
  
  cafdc399426afcb8523a207cb5496f4e
- SHA1
  
  5bcd97c6d36757bce8329af3f7deefff6677d138
- SHA256
  
  f86eb5b330384114bb42d127403b4756987a9a87deb277c376f8d7e95717e449
- SHA512
  
  d12cb75a35c6aa1ed401e3168777aca50de41c90a0f92570552ec177054ffb5ce90412c0a77c4e5950684820f57365d19dca1ab72b7f8114817ffb25a26523de
- SSDEEP
  
  1536:vaLuXE8XPIYyr7jvN0DoJ+cngdLeAyNx5UaLVel:SLuXzXwYyr6DoocnceAQUkVel
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/nsExec.dll
- Size
  
  6KB
- MD5
  
  b5a1f9dc73e2944a388a61411bdd8c70
- SHA1
  
  dc9b20df3f3810c2e81a0c54dea385704ba8bef7
- SHA256
  
  288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884
- SHA512
  
  b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8
- SSDEEP
  
  96:p7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNQ3e:lXhHR0aTQN4gRHdMqJVgNH
Score

3^/10
behavioral11 behavioral12

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Troldesh, Shade, Encoder.858

Loads dropped DLL

Reads user/profile data of web browsers

UPX packed file

Adds Run key to start application

Checks installed software on the system

Suspicious use of SetThreadContext

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12