troldesh | 9a6ef23b34dbb7a8e5bd82db794fc2b6e0a67fda707a6819c08b6a147e05d64a | Triage

Submit
Reports

Overview

overview

Static

static

3

612d089160...18.exe

windows7-x64

612d089160...18.exe

windows10-2004-x64

3

Sharing

General

Target

612d089160b04dbcd00bc13c8da42c8a_JaffaCakes118
Size

908KB
Sample

241020-jwteqazaqq
MD5

612d089160b04dbcd00bc13c8da42c8a
SHA1

c5275e34ef360cd3c9fe4e1c715b8734c62fee43
SHA256

9a6ef23b34dbb7a8e5bd82db794fc2b6e0a67fda707a6819c08b6a147e05d64a
SHA512

452ca5f00760846ec8529b01bfed30e7788b53ac9454ec05b6507f9a351f6c7274cb499f1528ad65f10c255c51288e1589c53e633ff79c327cbfef02b2b0cf94
SSDEEP

24576:mxJ1a6kIhKMFkPIyzgJ6Dx4IqzBhLHb1UV:dMFdJ4zqz3Tb1C

Score

10^/10

troldesh discovery persistence ransomware trojan upx

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

612d089160b04dbcd00bc13c8da42c8a_JaffaCakes118.exe

Resource

win7-20240903-en

troldesh discovery persistence ransomware trojan upx

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

612d089160b04dbcd00bc13c8da42c8a_JaffaCakes118.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

4 signatures

150 seconds

Malware Config

Targets

- Target
  
  612d089160b04dbcd00bc13c8da42c8a_JaffaCakes118
- Size
  
  908KB
- MD5
  
  612d089160b04dbcd00bc13c8da42c8a
- SHA1
  
  c5275e34ef360cd3c9fe4e1c715b8734c62fee43
- SHA256
  
  9a6ef23b34dbb7a8e5bd82db794fc2b6e0a67fda707a6819c08b6a147e05d64a
- SHA512
  
  452ca5f00760846ec8529b01bfed30e7788b53ac9454ec05b6507f9a351f6c7274cb499f1528ad65f10c255c51288e1589c53e633ff79c327cbfef02b2b0cf94
- SSDEEP
  
  24576:mxJ1a6kIhKMFkPIyzgJ6Dx4IqzBhLHb1UV:dMFdJ4zqz3Tb1C
Score

10^/10

troldesh discovery persistence ransomware trojan upx
- Troldesh, Shade, Encoder.858
  Troldesh is a ransomware spread by malspam.
  ransomware trojan troldesh
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

troldeshdiscoverypersistenceransomwaretrojanupx

behavioral2

© 2018-2025

Terms | Privacy