General
-
Target
ransomware.zip
-
Size
2.7MB
-
Sample
240508-dbkzyshc75
-
MD5
55c6d1601d19c258df09ef6552d1163e
-
SHA1
0561e738811b2d1bcaeb49fe7e1758f59a2843bf
-
SHA256
9748374c9b8025b43fe1e8dee646b80525bd98f795f5722106487adfa2a9d0aa
-
SHA512
37c2a2b486b9716833162f319322122fde7ae78add09c636388b7f3dfb5196caa7af090bdc52ed3690c0c6649c6f0cc1c7533dac5fdfbbed4c5258bc2d453143
-
SSDEEP
49152:khSSmaVW2zNin6NVp+Ob6gHhSSmaVW2zNin6NVp+Ob6gFhSSmaVW2zNin6NVp+OL:k8XbegPOb6K8XbegPOb6g8XbegPOb6i
Malware Config
Targets
-
-
Target
csrss.bin
-
Size
1.2MB
-
MD5
16a313d609f999958dbeb95cd4cf2ccf
-
SHA1
a012954a7257eaea94b4d21ca9c8997fefebade4
-
SHA256
3c1cf2acf484d12b8ce39d8f9881313d4ba7d3fb5977163881a9089c2c1b2b97
-
SHA512
d9cddf49804604b15178a64df8814e903948d7ca3ccc415e75946bfe11109817e72fcff4f21edb01b2f0b3e651cf20e94fda5f2930a5deaf17893ac5a97fce8c
-
SSDEEP
24576:/xQDBHwbrk6VC+bz1CTACJS/jxJxFhv4TFvE9vZXqXsP:/x5bR1MqxXFh4TdEVdqw
Score10/10-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
-
-
Target
msg[1].jpg
-
Size
1.2MB
-
MD5
16a313d609f999958dbeb95cd4cf2ccf
-
SHA1
a012954a7257eaea94b4d21ca9c8997fefebade4
-
SHA256
3c1cf2acf484d12b8ce39d8f9881313d4ba7d3fb5977163881a9089c2c1b2b97
-
SHA512
d9cddf49804604b15178a64df8814e903948d7ca3ccc415e75946bfe11109817e72fcff4f21edb01b2f0b3e651cf20e94fda5f2930a5deaf17893ac5a97fce8c
-
SSDEEP
24576:/xQDBHwbrk6VC+bz1CTACJS/jxJxFhv4TFvE9vZXqXsP:/x5bR1MqxXFh4TdEVdqw
Score10/10-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
-
-
Target
rad1903E.tmp
-
Size
1.2MB
-
MD5
16a313d609f999958dbeb95cd4cf2ccf
-
SHA1
a012954a7257eaea94b4d21ca9c8997fefebade4
-
SHA256
3c1cf2acf484d12b8ce39d8f9881313d4ba7d3fb5977163881a9089c2c1b2b97
-
SHA512
d9cddf49804604b15178a64df8814e903948d7ca3ccc415e75946bfe11109817e72fcff4f21edb01b2f0b3e651cf20e94fda5f2930a5deaf17893ac5a97fce8c
-
SSDEEP
24576:/xQDBHwbrk6VC+bz1CTACJS/jxJxFhv4TFvE9vZXqXsP:/x5bR1MqxXFh4TdEVdqw
Score10/10-
Troldesh, Shade, Encoder.858
Troldesh is a ransomware spread by malspam.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-