MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Troldesh


Vendor detections: 14


Intelligence 14 IOCs YARA 1 File information Comments

SHA256 hash: d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1
SHA3-384 hash: 6605676188fbb04837acee5d5a7199830adc1f762a79daa5e5c2c9ddc90145078c02552ebbe9756180b18089ccf8b26a
SHA1 hash: 8cffc99cda16d5d6b5192c62fefae6c0ac89b33d
MD5 hash: 1d46afb839b846ede01cb925470f0488
humanhash: vegan-helium-illinois-carpet
File name:d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1
Download: download sample
Signature Troldesh
File size:1'244'429 bytes
First seen:2021-09-28 09:23:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b90027f65707ca9644c551e337fa02ad (6 x Troldesh)
ssdeep 24576:XHtrdKYVVSrqGDohJ3STZG8vIn/sCBGnWsY0Dy0:XHtV7GwBSTc8An/4YF0
Threatray 52 similar samples on MalwareBazaar
TLSH T1A145235739D3902BF4AA8BF045E74A4B57707E62D9981A3432C6FB6A4C333C084B759B
File icon (PE):PE icon
dhash icon f8f0f4c8c8c8d8f0 (10 x ZLoader, 9 x RedLineStealer, 5 x Troldesh)
Reporter @JAMESWT_MHT
Tags:exe Troldesh

Intelligence


File Origin
# of uploads :
1
# of downloads :
147
Origin country :
IT IT
Mail intelligence
No data
Vendor Threat Intelligence
ID:
1
File name:
d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1
Verdict:
Malicious activity
Analysis date:
2021-09-28 10:31:08 UTC
Tags:
ransomware troldesh shade

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Connection attempt
Creating a file in the %temp% subdirectories
Moving a file to the %temp% subdirectory
Deleting a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Connection attempt to an infection source
Sending a TCP request to an infection source
Malware family:
Malicious Packer
Verdict:
Malicious
Result
Threat name:
CryptOne Shade
Detection:
malicious
Classification:
rans.evad
Score:
100 / 100
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionalty to change the wallpaper
Deletes shadow drive data (may be related to ransomware)
Detected CryptOne packer
Drops PE files with benign system names
Found Tor onion address
May use the Tor software to hide its network traffic
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Shade Ransomware
Behaviour
Behavior Graph:
Threat name:
Win32.Ransomware.AvaddonCrypt
Status:
Malicious
First seen:
2021-09-26 18:44:12 UTC
AV detection:
39 of 45 (86.67%)
Threat level:
  5/5
Result
Malware family:
troldesh
Score:
  10/10
Tags:
family:troldesh discovery persistence ransomware spyware stealer trojan upx
Behaviour
Interacts with shadow copies
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Drops file in Windows directory
Sets desktop wallpaper using registry
Adds Run key to start application
Checks installed software on the system
Looks up external IP address via web service
Reads user/profile data of web browsers
Modifies Installed Components in the registry
Modifies extensions of user files
UPX packed file
Deletes shadow copies
Suspicious use of NtCreateProcessExOtherParentProcess
Troldesh, Shade, Encoder.858
Unpacked files
SH256 hash:
a783833aaf77b85746d0520632a71482be1757dfdcc0a82c1102e7df70199018
MD5 hash:
a3075c07faef09600e3fd923838efc65
SHA1 hash:
894a0bdb301d2eb5751da8d1baf505282cc4a38c
Detections:
win_troldesh_auto
SH256 hash:
d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1
MD5 hash:
1d46afb839b846ede01cb925470f0488
SHA1 hash:
8cffc99cda16d5d6b5192c62fefae6c0ac89b33d
Malware family:
CryptOne
Verdict:
Malicious

YARA Signatures


MalareBazaar uses YARA rules from several public and non-public repositories, such as Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious proccess dumps they may create. Please note that only results from TLP:WHITE rules are being displayeyd.

Rule name:win_troldesh_auto
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.troldesh.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments