MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 213ccc660b77060313c9842e1d2d0215b5909235d54140daa21f0110c50e4715. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Troldesh


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments

SHA256 hash: 213ccc660b77060313c9842e1d2d0215b5909235d54140daa21f0110c50e4715
SHA3-384 hash: f5cc6f1c9df93316659949cba1d507cc014631eb8a4b7abb97e60889c21cd6e1a4701ac3da01a83df7cca6eb029738f3
SHA1 hash: 185d541acda9e0c6f59aaf733536f78a88c86a61
MD5 hash: 17c7cda30096c869c95c50852b4043c9
humanhash: solar-grey-mirror-double
File name:213ccc660b77060313c9842e1d2d0215b5909235d54140daa21f0110c50e4715
Download: download sample
Signature Troldesh
File size:1'031'992 bytes
First seen:2020-03-23 18:53:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash acb23d5e842bacc25710e858bb309110 (1 x Troldesh)
ssdeep 24576:Dw+ekoKYkrB43qLpM7diN+glAp3R6HTBz4:DwL1KYO43qLpMkN+MS3Yz4
Threatray 15 similar samples on MalwareBazaar
TLSH 2C2523C2B2221417D0B516786C57D23657319C4A8B7A89DA3759B08AFFBF2C0C8F6739
Reporter @Marco_Ramilli
Tags:exe Troldesh

Code Signing Certificate

Organisation:RZWQIWGOIHVDLFJDRN
Issuer:RZWQIWGOIHVDLFJDRN
Algorithm:sha1WithRSA
Valid from:Apr 12 22:20:15 2019 GMT
Valid to:Dec 31 23:59:59 2039 GMT
Serial number: 04E39DEB2E3D82BC418BD789392E8008
Thumbprint Algorithm:SHA256
Thumbprint: A1ADFE81A413749E0F41D7F995B61416FE3457B085F6F1DD233613E7CB9190F3
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence


File Origin
# of uploads :
1
# of downloads :
1'708
Origin country :
US US
Mail intelligence
No data
Vendor Threat Intelligence

YARA Signatures


MalareBazaar uses YARA rules from several public and non-public repositories, such as Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious proccess dumps they may create. Please note that only results from TLP:WHITE rules are being displayeyd.

Rule name:suspicious_packer_section
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:win_troldesh_auto
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_troldesh_g0
Author:Daniel Plohmann <daniel.plohmann<at>fkie.fraunhofer.de>
Description:Unpacked Shade binary, non-statically-linked part and specific strings (vs. CMSBrute)

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Troldesh

Executable exe 213ccc660b77060313c9842e1d2d0215b5909235d54140daa21f0110c50e4715

(this sample)

  
Delivery method
Distributed via web download

Comments