MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 50119da56e84ae4baa207a9391a0143fe5aa66c212aeba08e2d6d864af0a0d83. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vendor detections: 4

Intelligence 4 IOCs YARA 3 File information Comments

SHA256 hash: 50119da56e84ae4baa207a9391a0143fe5aa66c212aeba08e2d6d864af0a0d83
SHA3-384 hash: bfd6d7262c75ec059cf89994c1050d62bf9e582457ef7954ea93abea2c171a48e85f3011459219a9ecaa4c9bc6f1e0c8
SHA1 hash: e8d307b58856cd38c5b43f576a5dfd451f29b11c
MD5 hash: 0a0ae5d804271f56c1fa5e1e695cc514
humanhash: lamp-lima-uncle-oklahoma
File name:50119da56e84ae4baa207a9391a0143fe5aa66c212aeba08e2d6d864af0a0d83
Download: download sample
Signature Troldesh
File size:1'070'344 bytes
First seen:2020-03-30 07:06:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 919a9aec1eff347967bff351784e8b43 (2 x Troldesh)
ssdeep 12288:Mi94bywx1Dj5+h7ZCn0P5T7lHDbIi9dszYjN5HbPiLsptcyx7tbFEujtgDi:MHx13SZW0x5j5dsYnHeYpuyx7tx/tgDi
Threatray 15 similar samples on MalwareBazaar
TLSH BA35236EF0F36A33E19B4C35504E703B16B48285A7B9156FB1F5E64492B0E6274832BF
Reporter @Marco_Ramilli
Tags:exe Troldesh

Code Signing Certificate

Valid from:Dec 25 12:03:56 2018 GMT
Valid to:Dec 31 23:59:59 2039 GMT
Serial number: 7EF3009152FB26964326DE5092EC72CA
Intelligence: 2 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 74FF03BB7CD389AD2A561B89C88DA858BF33352C080D7A62538CDCA29776C9D0
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


File Origin
# of uploads :
# of downloads :
Origin country :
Mail intelligence
No data
Vendor Threat Intelligence

YARA Signatures

MalareBazaar uses YARA rules from several public and non-public repositories, such as Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious proccess dumps they may create. Please note that only results from TLP:WHITE rules are being displayeyd.

Rule name:suspicious_packer_section
Description:The packer/protector section names/keywords
Rule name:win_troldesh_auto
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_troldesh_g0
Author:Daniel Plohmann <daniel.plohmann<at>>
Description:Unpacked Shade binary, non-statically-linked part and specific strings (vs. CMSBrute)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download


Executable exe 50119da56e84ae4baa207a9391a0143fe5aa66c212aeba08e2d6d864af0a0d83

(this sample)

Delivery method
Distributed via web download