Overview

overview

10

Static

static

3

DoNothing.exe

windows11-21h2-x64

10

Resubmissions

19/03/2025, 12:07

250319-pap33awwdv 10

19/03/2025, 12:04

250319-n8zvgsznv5 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DoNothing-1.1.zip

  • Size

    1KB

  • Sample

    250319-n8zvgsznv5

  • MD5

    d4e107c88de6c414cf486a4c59680e22

  • SHA1

    3afbff25c24d6c241f6b7d688d02482843c15eea

  • SHA256

    88245085f618f12f441c95c7924fcb57409691942e8dbda1490a7d8c1720c24d

  • SHA512

    9e3ffe6588de25d611690d3204789dbcb5832352f44ee5079539f0be4ec4777915591a1e050d7a9ac7145293ec24c1f5e16b7c7f10fe77bac0844e57ee6d8a17

Score
10/10
troldeshdefense_evasiondiscoverypersistenceransomwaretrojanupx

Malware Config

Targets

    • Target

      DoNothing.exe

    • Size

      4KB

    • MD5

      06de0e898a82060eb95ac87fb8b52061

    • SHA1

      d1232795cebb38209e0b58d05a0b3864439398c5

    • SHA256

      56f452c753174e8a2048f851625c4de3e67c17cb5fbd3a753f7b0cac7932064f

    • SHA512

      091b60a2994791fd76985276e6d4272e138c1d9019b6caa37cab5850cfdd2916d62c98619b86f025cbebfff5b82a3a2d889cc1e6de1300c6d76e823e800f1bb0

    Score
    10/10
    troldeshdefense_evasiondiscoverypersistenceransomwaretrojanupx

    • Troldesh family

      troldesh

    • Troldesh, Shade, Encoder.858

      Troldesh is a ransomware spread by malspam.

      ransomwaretrojantroldesh

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks