Troldesh orShade, XTBLMalware
- Troldesh
Ransomware May download additional malware after encryptionFrom MISP Galaxy
Last reported 7 years ago, by Group-IB1 report
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1036Masquerading
“Scripting (T1064), User Execution (T1204), and Masquerading (T1036).”
- T1110Brute Force
“…dditional modules that allow it to not only encrypt the victim’s data, but also use infected hosts to mine cryptocurrency and conduct brute force attacks against CMSs.”
- T1204User Execution
“Scripting (T1064), User Execution (T1204), and Masquerading (T1036).”
- T1486Data Encrypted for Impact
“It’s T1486 – Data Encrypted for Impact.”
- T1496Resource Hijacking
“We can also identify a piece of cryptomining malware, so we also have T1496 – Resource Hijacking.”
- T1547.001Registry Run Keys / Startup Folder
“Registry Run Keys / Startup Folder”
What the reports say
1 report, newest first · the exact sentence from each-
50 Shades of Ransomware“For example, Shade ransomware (also known as “Troldesh”) has additional modules that allow it to not only encrypt the victim’s data, but also use infected hosts to mine cryptocurrency and conduct brute force attacks against CMSs.”
Indicators in its reports
named in the reports above- hxxp://mat.tradetoolsfx[.]comin 1 report
- mat.tradetoolsfx[.]comin 1 report
- eu1-zcash.flypool[.]orgin 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.