MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e43fb62c12fcf1be9f9982e81a59350a8f9dd2389198c0b332cef832a63aac0f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vendor detections: 4

Intelligence 4 IOCs YARA 3 File information Comments

SHA256 hash: e43fb62c12fcf1be9f9982e81a59350a8f9dd2389198c0b332cef832a63aac0f
SHA3-384 hash: 2ac075cd74801086a979d94e601f1a0b88c77d67fd9f926fa6eca7c182a1132e9d6f43385cd3ba9bd489d1f4dc527ffb
SHA1 hash: d8418df846e93da657312acd64a671887e8d0fa7
MD5 hash: 8a714ad99ae5dbd5fd8432efafb5b8e6
humanhash: timing-bacon-mango-arkansas
File name:e43fb62c12fcf1be9f9982e81a59350a8f9dd2389198c0b332cef832a63aac0f
Download: download sample
Signature Troldesh
File size:1'086'216 bytes
First seen:2020-03-23 18:54:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash de3ab2af93982fc1df824dd1fb9b4288 (1 x Troldesh)
ssdeep 12288:X9RvHO/Y9IreCfctWBc+hCUwbLJwezpEnfc27nVMHrfTpWr33W5oz5yOt3G/f/vW:XKIoeCEtac88bLEcSnVKf1U55yOA34Cm
Threatray 15 similar samples on MalwareBazaar
TLSH CC3523C1F6435507EE744AB3B2A6C470CC52B212FB4031EE34ADED4FE6A42AB5A78435
Reporter @Marco_Ramilli
Tags:exe Troldesh

Code Signing Certificate

Valid from:Jan 17 11:38:03 2019 GMT
Valid to:Dec 31 23:59:59 2039 GMT
Serial number: -4088224AACFE9C53B75EEFF5CE102C67
Thumbprint Algorithm:SHA256
Thumbprint: CAE8C42D7EA0DBFB7B06153E7FDB90A567FE6D03A27407155D9ADD5B64E48EBE
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


File Origin
# of uploads :
# of downloads :
Origin country :
Mail intelligence
No data
Vendor Threat Intelligence

YARA Signatures

MalareBazaar uses YARA rules from several public and non-public repositories, such as Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious proccess dumps they may create. Please note that only results from TLP:WHITE rules are being displayeyd.

Rule name:suspicious_packer_section
Description:The packer/protector section names/keywords
Rule name:win_troldesh_auto
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_troldesh_g0
Author:Daniel Plohmann <daniel.plohmann<at>>
Description:Unpacked Shade binary, non-statically-linked part and specific strings (vs. CMSBrute)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download


Executable exe e43fb62c12fcf1be9f9982e81a59350a8f9dd2389198c0b332cef832a63aac0f

(this sample)

Delivery method
Distributed via web download