Overview

overview

10

Static

static

10

TROLLLOLL-main.zip

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TROLLLOLL-main.zip

  • Size

    78.7MB

  • MD5

    71e713dd3adb5162493877d698767493

  • SHA1

    75c04f6ad957c7a5057963339476408ea8e507db

  • SHA256

    6b55434b24ebda6659479358d5d66ae7ee02552656234a36fcd2a7c7c4b852c9

  • SHA512

    2b67cbea20eca6714390c4cd34a2452a726b41eacda0cc9729224cbc6ec6169fdda2c6857be386f620ffb1bf50e3f31e21f26eda2ef5fa2e8e8996590a5c7b4e

  • SSDEEP

    1572864:viu5xhyD0sNAD5YIE7HhN9n0NeTBXbt6hID3dYdjacB2RVgZ06Kmj7uqi0e:vnV4ANYIk3x3lXJ6o+d2c8b+0dmPje

Score
10/10
pyinstallerteststealeriumquasarempyreanskuld

Malware Config

Extracted

Family

stealerium

C2

https://discord.com/api/webhooks/1229897378534785024/w913pfbmcplo1dycWrPCWhWLxOF9dTH_FifkgM7MDcaPqzxlJtqs63z7GsIqXUNRUY1Z

Extracted

Family

quasar

Version

1.4.1

Botnet

Test

C2

47.134.26.200:4782

193.161.193.99:23325
Mutex

9cabbafb-503b-49f1-ab22-adc756455c10

Attributes
  • encryption_key

    8B93C77AC1C58EA80A3327E9FD26246A79EF3B8E

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    MS Build Tools

  • subdirectory

    Microsoft-Build-Tools

Extracted

Family

skuld

C2

https://discord.com/api/webhooks/1241946879428792391/E4kLuT4H7xIgf8x5LgPsoaZ6xw6Se0ShMgu1D6zvkZ4oHp-vBo21j2Pn6QWrNlMwFzCF

Signatures

  • Detects Empyrean stealer 1 IoCs
  • Empyrean family
    empyrean
  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Skuld family
    skuld
  • Stealerium family
    stealerium
  • Detects Pyinstaller 4 IoCs
    pyinstaller
  • Unsigned PE 8 IoCs

    Checks for missing Authenticode signature.

Files

  • TROLLLOLL-main.zip
    .zip
  • TROLLLOLL-main/bigsigma.exe
    .exe windows:5 windows x64 arch:x64

    f4f2e2b03fe5666a721620fcea3aea9b


    Headers

    Imports

    Sections

  • bigsigma.pyc
  • TROLLLOLL-main/build.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • TROLLLOLL-main/hello.bat
  • TROLLLOLL-main/hello.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

  • TROLLLOLL-main/main.exe
    .exe windows:5 windows x64 arch:x64

    1e92fd54d65284238a0e3b74b2715062


    Headers

    Imports

    Sections

  • main.pyc
  • TROLLLOLL-main/miner.exe
    .exe windows:6 windows x64 arch:x64

    69b5272077c55acc3c107da8471ab948


    Headers

    Imports

    Sections

  • TROLLLOLL-main/ohio.exe
    .exe windows:5 windows x64 arch:x64

    f4f2e2b03fe5666a721620fcea3aea9b


    Headers

    Imports

    Sections

  • ohio.pyc
  • TROLLLOLL-main/skuld.exe
    .exe windows:6 windows x64 arch:x64

    c2d457ad8ac36fc9f18d45bffcd450c2


    Headers

    Imports

    Sections

  • TROLLLOLL-main/trolled.exe
    .exe windows:5 windows x64 arch:x64

    f4f2e2b03fe5666a721620fcea3aea9b


    Headers

    Imports

    Sections

  • trolled.pyc