MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5013dc9e2ddbe9ddd90af638466379f876b70ebe504d62e72ed166480a4d4f83. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vendor detections: 4

Intelligence 4 IOCs YARA 3 File information Comments

SHA256 hash: 5013dc9e2ddbe9ddd90af638466379f876b70ebe504d62e72ed166480a4d4f83
SHA3-384 hash: 2050ebd9903988768c0ebb2d55bd63a1234e0f4d0074c184406e6aee3d460c60c0246145302c95da6ca5c055ef3b4743
SHA1 hash: 805a1193f029840c1a2fc057942b72e5fb93dffd
MD5 hash: e2b8c884e9a91430ca6666f06aedf42e
humanhash: seventeen-river-utah-harry
File name:5013dc9e2ddbe9ddd90af638466379f876b70ebe504d62e72ed166480a4d4f83
Download: download sample
Signature Troldesh
File size:1'316'616 bytes
First seen:2020-03-23 18:47:37 UTC
Last seen:2020-03-23 18:59:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 94eeb5c73c069d473e4fc6684332c7cb (3 x Troldesh)
ssdeep 24576:+MlX1xXDLIkvMedOubwnrEXLy8uphS7NRc/SB0V386/P1EnGJZV:jlFxnIf8wnrmW3ORuSBy3r/PsGPV
Threatray 15 similar samples on MalwareBazaar
TLSH AD55235DBD46F239C438D8B0854C854BEE5ABD0F8F0E66531288E570E57A6C3A8BC5EC
Reporter @Marco_Ramilli
Tags:exe Troldesh

Code Signing Certificate

Valid from:Feb 26 14:07:51 2019 GMT
Valid to:Dec 31 23:59:59 2039 GMT
Serial number: -22D5DC96D768D869B434CEBA8E20922A
Intelligence: 3 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 4B5FB158616D90BBB0B534B81D2BE3DE2526909686E069370AD42AAD1AF042AE
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


File Origin
# of uploads :
# of downloads :
Origin country :
Mail intelligence
No data
Vendor Threat Intelligence

YARA Signatures

MalareBazaar uses YARA rules from several public and non-public repositories, such as Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious proccess dumps they may create. Please note that only results from TLP:WHITE rules are being displayeyd.

Rule name:suspicious_packer_section
Description:The packer/protector section names/keywords
Rule name:win_troldesh_auto
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_troldesh_g0
Author:Daniel Plohmann <daniel.plohmann<at>>
Description:Unpacked Shade binary, non-statically-linked part and specific strings (vs. CMSBrute)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download


Executable exe 5013dc9e2ddbe9ddd90af638466379f876b70ebe504d62e72ed166480a4d4f83

(this sample)

Delivery method
Distributed via web download