MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f017eac0a0bd2f5c04a2be165a1f3e9d3146b9bf20e6cc7f96c183471c8802d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Troldesh

Vendor detections: 18

Intelligence 18 IOCs YARA 6 File information Comments

SHA256 hash:	0f017eac0a0bd2f5c04a2be165a1f3e9d3146b9bf20e6cc7f96c183471c8802d
SHA3-384 hash:	8a4f41feefa99dddb081badbf129fa41caf03400e29479c65580d2be18b93a822aa90d5a615e9a16c5594f5a5e11572c
SHA1 hash:	b5b254c04c93612d759e281858a3147c826db040
MD5 hash:	d4dd2a704dc4058951b330bf9e72df57
humanhash:	wyoming-north-hydrogen-pasta
File name:	0f017eac0a0bd2f5c04a2be165a1f3e9d3146b9bf20e6cc7f96c183471c8802d.exe
Download:	download sample
Signature	Troldesh Create hunting rule
File size:	952'584 bytes
First seen:	2026-09-14 05:56:19 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	94c99ca1c43e1cca02e0fdadf543022a (1 x Troldesh)
ssdeep	24576:DIH9zqI1sZguuDioS+7HyodRCPL2//phcQggqclYl:eh8gM+7HVdRCPiZtgRc8
TLSH	T12A1523B221980CABF11913F756FACE760988F4907355AC115A388B6FFC5A2D138D0AE7
TrID	50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	60c4dbc96eb0d871 (1 x Troldesh)
Reporter	whack_sh
Tags:	exe Troldesh

Intelligence

File Origin

# of uploads :

# of downloads :

167

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

CryptOne

Details

Link:

https://research.acce.ciphertechsolutions.com/results/4a641512-7ba6-455d-bc7c-2220eb1f9252/

Malware family:

troldesh

ID:

File name:

ural_avia.rar

Verdict:

Malicious activity

Analysis date:

2019-04-08 05:33:41 UTC

Tags:

opendir loader ransomware troldesh shade evasion trojan

Link:

https://app.any.run/tasks/68e3d6cb-7c61-4807-8cdb-5d659bd0e2b0

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/85321/

Detection(s):

SecuriteInfo.com.Trojan.Encoder.858.8808.29243.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Using the Windows Management Instrumentation requests

Creating a file

Connection attempt

Creating a file in the %temp% subdirectories

Moving a file to the %temp% subdirectory

Sending a custom TCP request

Launching a service

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

adaptive-context anti-debug bankingtrojan emotet fingerprint hacktool keylogger microsoft_visual_cc packed reconnaissance troldesh

Link:

https://www.filescan.io/uploads/6aa78cbb838cb41b6350d09f/reports/b833088e-d012-479a-9a18-d3ddbd813e2e/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/0f017eac0a0bd2f5c04a2be165a1f3e9d3146b9bf20e6cc7f96c183471c8802d

Verdict:

Malicious

File Type:

exe x32

First seen:

2019-04-08T00:54:00Z UTC

Last seen:

2026-09-09T17:47:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/0f017eac0a0bd2f5c04a2be165a1f3e9d3146b9bf20e6cc7f96c183471c8802d/results?tab=lookup

Malware family:

Shade

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/d08ebfa3-ad2d-449d-9db3-06746e1e5980

Result

Threat name:

CryptOne

Detection:

malicious

Classification:

rans.spre.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1972492

Signature

AI detected suspicious PE / MSI digital signature

Contains functionalty to change the wallpaper

Detected CryptOne packer

Infects executable files (exe, dll, sys, html)

Joe Sandbox ML detected suspicious sample

May disable shadow drive data (uses vssadmin)

May use the Tor software to hide its network traffic

Multi AV Scanner detection for submitted file

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: System File Execution Location Anomaly

Stores a public key to the registry (likely related to ransomware)

Tries to harvest and steal browser information (history, passwords, etc)

Unusual module load detection (module proxying)

Writes many files with high entropy

Yara detected CryptOne packer

Behaviour

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/0f017eac0a0bd2f5c04a2be165a1f3e9d3146b9bf20e6cc7f96c183471c8802d

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/d4dd2a704dc4058951b330bf9e72df57

Detection:

troldesh

Link:

https://mwdb.cert.pl/sample/0f017eac0a0bd2f5c04a2be165a1f3e9d3146b9bf20e6cc7f96c183471c8802d/

Threat name:

Win32.Ransomware.Troldesh

Status:

Malicious

First seen:

2019-04-08 07:29:17 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

31 of 36 (86.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=b4ax5lakbpjplqckfpqwlipt5hjri2436ihgzr7znqmdi4oiqawq._file

Verdict:

malicious

Label(s):

Troldesh

Link:

https://reports.threatray.com/1764ec64-81e5-4610-af29-bf0bf3f1ae9b

Result

Malware family:

troldesh

Score:

10/10

Tags:

family:troldesh discovery persistence ransomware spyware stealer suricata trojan upx

Link:

https://tria.ge/reports/260914-gnp18aszav/

Behaviour

Suspicious behavior: EnumeratesProcesses

Enumerates physical storage devices

System Location Discovery: System Language Discovery

UPX packed file

Adds Run key to start application

Checks installed software on the system

Executes dropped EXE

Reads user/profile data of web browsers

Suricata alert: Tor Node X.509 Certificate Pattern Detected - Inbound

Family: Troldesh, Shade, Encoder.858

Unpacked files

SH256 hash:

0f017eac0a0bd2f5c04a2be165a1f3e9d3146b9bf20e6cc7f96c183471c8802d

MD5 hash:

d4dd2a704dc4058951b330bf9e72df57

SHA1 hash:

b5b254c04c93612d759e281858a3147c826db040

Link:

https://www.unpac.me/results/e5211d79-ae6c-4bcf-995b-f6141cb2472a/

SH256 hash:

a783833aaf77b85746d0520632a71482be1757dfdcc0a82c1102e7df70199018

MD5 hash:

a3075c07faef09600e3fd923838efc65

SHA1 hash:

894a0bdb301d2eb5751da8d1baf505282cc4a38c

Detections:

win_troldesh_auto

Link:

https://www.unpac.me/results/e5211d79-ae6c-4bcf-995b-f6141cb2472a/

Parent samples :

c8aa0a26ce1bab524dd88d314d197a2af59b5b67db0fff3d82690b74e7d95c4e
64f7ee64a85714afa869271965ada1e1ba588b07a205a3a5eda41e9265512b0b
6192163bbb9343a274904093b94d6b12111a88bf24b58cbf9ed2c1463503e022
6d6089fee5f86170c5b3485a626cc6073631d09004f298da7b690b12a9482086
cd2bc2ceb0e1b7d7c31f7a2aec7e838d3a90767ed3d02e1720170875e4a23cb6
df2894b4298be05620b329d27bf0b45314629316fd6a082b6d90bbdfe9bf5a53
ed801a3e54843afe989aadd69cdab5e6fbf00e8e02742f354519b4b16de8f31c
62214ccdcb1052b518e6059060daec143430c1ae13a799873ebabea7f3eae217
e32998012af31476e39dedb2f725269dbd0a165d74b53a32e5e359da3a01221d
8025918ab649e33642c4eb74c2814397e971d5ab68e631e91649354c8dec2be5
c197da0fda316a92c66744bf13c77891e9f39cc10fbfebc42285a8b4761440b5
1e43c5be3ac264cf5eba9bc4647d2004012e283050924da06d5c1da18255a3b1
c659b1a6e09e7d7b98b368984d8d8e70ceee5666e3a7f54cf5a0fd90cc9f0eea
b370a4f93fb6e655f131329f027615c6828cdfc7002d7b0692f5d28e952c2194
d09c59de1d634faf6852ea9cbfa01d721c3f0a50da1fc2798acc0864409888f9
a56e155faefc72a0f5174e27670cd9f8e8c66a646744feedd0211e37f6aef6fb
d158534622b057b387a617ebe2931fef6d5c7d386b6dfbeb652c4781846f87c1
32c3fc22cab918195b3590ae17a424b5f79c145f6ee8c7d4aff376ce070248fc
62230c1651781d4ab7234fe6d747dc6cc79c1381f4ee15a84cf9a2176dcdc5d9
5ca2121b8b5edb7d1de8afd934299cc83900dd2b4ba80d95b1693b11d06155fd
0f017eac0a0bd2f5c04a2be165a1f3e9d3146b9bf20e6cc7f96c183471c8802d

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0f017eac0a0bd2f5c04a2be165a1f3e9d3146b9bf20e6cc7f96c183471c8802d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.