troldesh | ed801a3e54843afe989aadd69cdab5e6fbf00e8e02742f354519b4b16de8f31c

Target

02e8c7af3724ff535da627197920ad14.exe
Size

1.2MB
Sample

240417-skhzaade44
MD5

02e8c7af3724ff535da627197920ad14
SHA1

794bd6f52a9673e1146321fa2545c580858c0d5f
SHA256

ed801a3e54843afe989aadd69cdab5e6fbf00e8e02742f354519b4b16de8f31c
SHA512

8a8710ffced04c30f5c43c71ebcbcf56f7b096836f67d1a847db4a8df4f39e291f3e7119f45f03fa1ca0abd0021f81abd31bb775fa22fe2340c1cf24f19f2555
SSDEEP

24576:XHtrdKYVVSrqGDohJ3STZG8vIn/sCBGnWsY0Dyk:XHtV7GwBSTc8An/4YFk

Score

10^/10

Malware Config

Targets

- Target
  
  02e8c7af3724ff535da627197920ad14.exe
- Size
  
  1.2MB
- MD5
  
  02e8c7af3724ff535da627197920ad14
- SHA1
  
  794bd6f52a9673e1146321fa2545c580858c0d5f
- SHA256
  
  ed801a3e54843afe989aadd69cdab5e6fbf00e8e02742f354519b4b16de8f31c
- SHA512
  
  8a8710ffced04c30f5c43c71ebcbcf56f7b096836f67d1a847db4a8df4f39e291f3e7119f45f03fa1ca0abd0021f81abd31bb775fa22fe2340c1cf24f19f2555
- SSDEEP
  
  24576:XHtrdKYVVSrqGDohJ3STZG8vIn/sCBGnWsY0Dyk:XHtV7GwBSTc8An/4YFk
Score

10^/10

troldesh discovery persistence ransomware spyware stealer trojan upx
- Troldesh, Shade, Encoder.858
  Troldesh is a ransomware spread by malspam.
  ransomware trojan troldesh
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies Installed Components in the registry
  persistence
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2 behavioral3 behavioral4 behavioral5

MITRE ATT&CK Matrix ATT&CK v13

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Troldesh, Shade, Encoder.858

Deletes shadow copies

Modifies Installed Components in the registry

Reads user/profile data of web browsers

UPX packed file

Adds Run key to start application

Checks installed software on the system

Enumerates connected drives

Sets desktop wallpaper using registry

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5