cryptolocker | hxxp://malware repo | Triage™

Login
Reports

Overview

overview

Static

static

1

URLScan

urlscan

http://malware repo

windows11-21h2-x64

Sharing

Copy URL Twitter E-mail

General

Target
http://malware repo
Sample261029-vaej8a1x8j

Score

10^/10

cryptolocker troldesh defense_evasion discovery execution persistence ransomware suricata trojan upx

Static task

static1

URLScan task

urlscan1

Behavioral task

behavioral1

Sample

http://malware repo

Resource

win11-20260911-en

windows11-21h2-x64

29 signatures

900 seconds

defense_evasion discovery execution cryptolocker troldesh persistence ransomware suricata trojan upx

Malware Config

Targets

- Target
  http://malware repo
Score

10^/10

defense_evasion discovery execution cryptolocker troldesh persistence ransomware suricata trojan upx
- Family: CryptoLocker
  Ransomware family with multiple variants.
  ransomware cryptolocker
- Family: Troldesh, Shade, Encoder.858
  Troldesh is a ransomware spread by malspam.
  ransomware trojan troldesh
- Disables Task Manager via registry modification
  defense_evasion
- Downloads MZ/PE file
- Executes dropped EXE
- Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound
  Network activity triggered a Suricata alert
  suricata
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Modifies WinLogon
  persistence
- Sets desktop wallpaper using registry
  ransomware
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

Windows Command Shell

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Modify Registry

Subvert Trust Controls

SIP and Trust Provider Hijacking

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

System Time Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Defacement

Tasks

static1

urlscan1

behavioral1

defense_evasiondiscoveryexecutioncryptolockertroldeshpersistenceransomwaresuricatatrojanupx

© 2018-2026

Terms | Privacy