Extracted

Extracted

Extracted

• • Target

    TROLLLOLL-main/main.exe

  • Size

    18.5MB

  • MD5

    69a7f0f924be865d872125bd54dfca3d

  • SHA1

    54994d0074cc1819575f9ba1e45c9bd8b2232ab6

  • SHA256

    5a4163a2499b68630f50b86446ef82d0e0e64c2f89202038042765adedc374bd

  • SHA512

    be98b08245d9ac83e5bcdea08fbf9b55097b00c9fb8d958f291ecc5cb3e3f9a8cfd10376262eef1691c68214c5246822d010ce29a94d67c49fdc5c6b8c259c87

  • SSDEEP

    393216:VqPnLFXlrPTQ8DOETgs77fGFUgUbkxvExu/36q:MPLFXNbQhE7XXIGkb

  Score

  7^/10

  upxpersistenceprivilege_escalationspywarestealer

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2