MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e39fd52523f742331dc20ee90a051e456561481ef4c360a40ffaac292cb6c37b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vendor detections: 4

Intelligence 4 IOCs YARA 3 File information Comments

SHA256 hash: e39fd52523f742331dc20ee90a051e456561481ef4c360a40ffaac292cb6c37b
SHA3-384 hash: b26f18ea31c2ac7cb38e11de084745382aae0b79391b5a17ca8cc358d0a1399da43722c0d80586ce95f4a8b77d532a20
SHA1 hash: 84d5bec52b0c1b75e9ae33f6a1a049ffad2d5be3
MD5 hash: 169b40c14d01ed0d87eecaf37fff9f8d
humanhash: cold-juliet-october-gee
File name:e39fd52523f742331dc20ee90a051e456561481ef4c360a40ffaac292cb6c37b
Download: download sample
Signature Troldesh
File size:1'415'944 bytes
First seen:2020-03-23 16:24:39 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4879db8a53372db357c5d9e1d8294e93 (1 x Troldesh)
ssdeep 12288:FBpIwAR/kkMD/thCtMybHDYmCTO8f9QdQ0qqA28tHbgPXv5uT8rsOJLnM27GZe2:F7Iw8cjhSHDY3XQ2WzC7guYrNJDM26T
Threatray 15 similar samples on MalwareBazaar
TLSH F36523B3D0C9B623DCF756BDC101C985B070BBE5A5310C510CE26C2A252DBDA7DBA2A7
Reporter @Marco_Ramilli
Tags:exe Troldesh

Code Signing Certificate

Valid from:Dec 4 11:14:09 2018 GMT
Valid to:Dec 31 23:59:59 2039 GMT
Serial number: -6FD99C65C8D53A62BEF9DA405EA0A01F
Thumbprint Algorithm:SHA256
Thumbprint: D85924B0F8600147BDDDAA1842C268248FADBCDBE4CCB1695D3B448A91577BFD
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


File Origin
# of uploads :
# of downloads :
Origin country :
Mail intelligence
No data
Vendor Threat Intelligence

YARA Signatures

MalareBazaar uses YARA rules from several public and non-public repositories, such as Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious proccess dumps they may create. Please note that only results from TLP:WHITE rules are being displayeyd.

Rule name:suspicious_packer_section
Description:The packer/protector section names/keywords
Rule name:win_troldesh_auto
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_troldesh_g0
Author:Daniel Plohmann <daniel.plohmann<at>>
Description:Unpacked Shade binary, non-statically-linked part and specific strings (vs. CMSBrute)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download


Executable exe e39fd52523f742331dc20ee90a051e456561481ef4c360a40ffaac292cb6c37b

(this sample)

Delivery method
Distributed via web download