MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e93b9a00886b7a569dc09337361d246c4ac74d3a061579ea4ad33b9ad19f7bde. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Vendor detections: 4

Intelligence 4 IOCs YARA 3 File information Comments

SHA256 hash: e93b9a00886b7a569dc09337361d246c4ac74d3a061579ea4ad33b9ad19f7bde
SHA3-384 hash: db18847e587c1ac7f4fce8880fbba05b3d2e99ae6fe9082117b93dfdbdbd089def55d0a0c66c69ea81408d298a000469
SHA1 hash: f1a41d791ff9578621714ddf35edd110e1dc1b17
MD5 hash: 035a27584ca5c489b0f5b3e58fccb139
humanhash: may-nevada-lion-stairway
File name:e93b9a00886b7a569dc09337361d246c4ac74d3a061579ea4ad33b9ad19f7bde
Download: download sample
Signature Troldesh
File size:963'584 bytes
First seen:2020-03-23 16:20:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7c0de21402f71b798f66e6d527edd4d5 (1 x Troldesh)
ssdeep 24576:3eFW2Er1a0wJleRvG92zfcj3QNff+Ia18V4:3eFuA9wvGATkAhf/i8i
Threatray 15 similar samples on MalwareBazaar
TLSH 1B2523412CE0CEB6C09626F249775413D99E6C0E1A24358B758ABE2EDF317C29B2D35F
Reporter @Marco_Ramilli
Tags:exe Troldesh


File Origin
# of uploads :
# of downloads :
Origin country :
Mail intelligence
No data
Vendor Threat Intelligence

YARA Signatures

MalareBazaar uses YARA rules from several public and non-public repositories, such as Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious proccess dumps they may create. Please note that only results from TLP:WHITE rules are being displayeyd.

Rule name:suspicious_packer_section
Description:The packer/protector section names/keywords
Rule name:win_troldesh_auto
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_troldesh_g0
Author:Daniel Plohmann <daniel.plohmann<at>>
Description:Unpacked Shade binary, non-statically-linked part and specific strings (vs. CMSBrute)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download


Executable exe e93b9a00886b7a569dc09337361d246c4ac74d3a061579ea4ad33b9ad19f7bde

(this sample)

Delivery method
Distributed via web download