MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e3f6a7a2d6628adf2956c3c1f387c2bd178b48e170a71368ae3e7f8c20b8e213. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vendor detections: 4

Intelligence 4 IOCs YARA 3 File information Comments

SHA256 hash: e3f6a7a2d6628adf2956c3c1f387c2bd178b48e170a71368ae3e7f8c20b8e213
SHA3-384 hash: 1b1c47859b42359132e75168a5e6efad6ef15ed74f9e30b98f6060d8ef9b9d9a395ea64bebc965f58fae33e1117e9e0b
SHA1 hash: 04c7eac927083a8578905e6357dc4b8ea187311e
MD5 hash: 6179ca7d43b30020be84e6c54ce81934
humanhash: washington-lamp-network-artist
File name:e3f6a7a2d6628adf2956c3c1f387c2bd178b48e170a71368ae3e7f8c20b8e213
Download: download sample
Signature Troldesh
File size:1'244'424 bytes
First seen:2020-03-23 16:26:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b90027f65707ca9644c551e337fa02ad (6 x Troldesh)
ssdeep 24576:XHtrdKYVVSrqGDohJ3STZG8vIn/sCBGnWsY0DyF:XHtV7GwBSTc8An/4YFF
Threatray 32 similar samples on MalwareBazaar
TLSH 6E45235739D3902BF4AA8BF045E74A4B57707E62D9981A3432C6FB6A4C333C084B759B
Reporter @Marco_Ramilli
Tags:exe Troldesh

Code Signing Certificate

Valid from:Feb 26 11:42:52 2019 GMT
Valid to:Dec 31 23:59:59 2039 GMT
Serial number: -4DF16BFC5DE3926AB99CCCC3E4A34030
Intelligence: 3 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 6906B4BB26799857A176755463E8C649FBA1A6C7026D5C3A4B4F2ED68D6EAC2F
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


File Origin
# of uploads :
# of downloads :
Origin country :
Mail intelligence
No data
Vendor Threat Intelligence

YARA Signatures

MalareBazaar uses YARA rules from several public and non-public repositories, such as Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious proccess dumps they may create. Please note that only results from TLP:WHITE rules are being displayeyd.

Rule name:suspicious_packer_section
Description:The packer/protector section names/keywords
Rule name:win_troldesh_auto
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_troldesh_g0
Author:Daniel Plohmann <daniel.plohmann<at>>
Description:Unpacked Shade binary, non-statically-linked part and specific strings (vs. CMSBrute)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download


Executable exe e3f6a7a2d6628adf2956c3c1f387c2bd178b48e170a71368ae3e7f8c20b8e213

(this sample)

Delivery method
Distributed via web download