troldesh | 19a087166b899e4f6c63c76e3a8978a2429ed4e3f2479299c4b2a3f8872f6e3d

General

Target

Wallpaper.zip
Size

1.7MB
Sample

240731-j37wpazdjb
MD5

a66b6c0725433bb071089bb84bd0186c
SHA1

c45338281936074cab03d2bba30e899cae8df29c
SHA256

19a087166b899e4f6c63c76e3a8978a2429ed4e3f2479299c4b2a3f8872f6e3d
SHA512

3e93794fe6d7048a452a685d6a65457061467b8715fd59769db4f8d62141d95505a50135a7ecd5b3684f911b94d34320335de2bf71854dcc94a6d285b3ad9a6f
SSDEEP

49152:Rz5/rgN4ypUO9DJmePL4IFMt7wQmKX26ktvAxkulD7Gm6rD:N5zQQ+L4yQm8ZkuCGOm6rD

Score

10^/10

Malware Config

Targets

- Target
  
  Wallpaper.jpg
- Size
  
  1.7MB
- MD5
  
  fbc1ec46f422d917dfb19ca4e20f963e
- SHA1
  
  9eae41c1bd0f13786b101af0d0914dc780a0b00f
- SHA256
  
  df57305ce989d8261057e38313b535928955d9331d86b80439802fbf0fbc6776
- SHA512
  
  70e618857fb653ed79fcb6b4f8c89afa3b48a8542d1d945af1a2b0623e60d9f0a7461c223eee2b35232a4d87d32275ab584a20b84deedd2e1349606b88ad3e74
- SSDEEP
  
  49152:Id3C4LLGujE0qwt9936ihsJqtW/xH/CXOX5H6j/G:IdzLLGubq090/2WIeX5H6j/G
Score

10^/10

troldesh bootkit discovery persistence privilege_escalation ransomware trojan upx
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Troldesh, Shade, Encoder.858
  Troldesh is a ransomware spread by malspam.
  ransomware trojan troldesh
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1