MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8c452946e291216b7bba41b8e7f9a3eb5ee9178c9559e4b5017ed832d90b94f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Troldesh


Vendor detections: 5


Intelligence 5 IOCs YARA 3 File information Comments

SHA256 hash: a8c452946e291216b7bba41b8e7f9a3eb5ee9178c9559e4b5017ed832d90b94f
SHA3-384 hash: 16c1432998ea057f83e43a4f1f64a03a2ac54f033faf51e3e16d67fb84f099cda7e58491abb8d216496e64845137af85
SHA1 hash: 0403524c482fd0aaf166604d3d18cc80b308034b
MD5 hash: 7cdcc3f98b8ac064a1a0f0b978a125a1
humanhash: utah-undress-xray-illinois
File name:a8c452946e291216b7bba41b8e7f9a3eb5ee9178c9559e4b5017ed832d90b94f
Download: download sample
Signature Troldesh
File size:1'596'104 bytes
First seen:2020-03-23 18:57:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c7f42986e1f3c290387a2002e29b71a6 (1 x Troldesh)
ssdeep 24576:QpTUqxDuI7WRoIlt2dTsJ63hHjGGYWYwMqP:ETxD/WRoIlIdTskNGIMqP
Threatray 15 similar samples on MalwareBazaar
TLSH 897533503753EA17DE62323C2D8FE1620333540A479ED5EAE32DA07197F63978895C5E
Reporter @Marco_Ramilli
Tags:exe Troldesh

Code Signing Certificate

Organisation:FFGDBATU
Issuer:FFGDBATU
Algorithm:sha1WithRSA
Valid from:Feb 13 17:16:07 2019 GMT
Valid to:Dec 31 23:59:59 2039 GMT
Serial number: 4F0F63901487D89C48B63D20D8D5C895
Thumbprint Algorithm:SHA256
Thumbprint: BB033FE5C7266F5FDA0F603A9B18FE5A0E72E0A54EDA484443EC63871EE7D73B
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence


File Origin
# of uploads :
1
# of downloads :
1'721
Origin country :
FR FR
Mail intelligence
No data
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Kryptik
Status:
Malicious
First seen:
2019-02-14 08:44:56 UTC
File Type:
PE (Exe)
AV detection:
30 of 31 (96.77%)
Threat level:
  5/5

YARA Signatures


MalareBazaar uses YARA rules from several public and non-public repositories, such as Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious proccess dumps they may create. Please note that only results from TLP:WHITE rules are being displayeyd.

Rule name:suspicious_packer_section
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/
Rule name:win_troldesh_auto
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_troldesh_g0
Author:Daniel Plohmann <daniel.plohmann<at>fkie.fraunhofer.de>
Description:Unpacked Shade binary, non-statically-linked part and specific strings (vs. CMSBrute)

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Troldesh

Executable exe a8c452946e291216b7bba41b8e7f9a3eb5ee9178c9559e4b5017ed832d90b94f

(this sample)

Comments