Excerpt
Overview
“Troldesh”, aka Encoder.858 or Shade, is a Trojan and a crypto-ransomware variant created in Russia and spread all over the world.
Troldesh is based on so-called encryptors that encrypt all of the user’s personal data and extort money to decrypt the files. Troldesh encrypts a user’s files with an “.xtbl” extension. Troldesh is spread initially via e-mail spam. A distinctive feature of the Troldesh attack is direct communication with the victim. While the most Ransom-Trojan attackers try to hide themselves and avoid any direct contact, Troldesh’s creators provide their victims with an e-mail address. The attackers use this email correspondence to demand a ransom an…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Check Point on blog.checkpoint.com.
More from Check Point88
- Gozi: The Malware with a Thousand FacesCheck Point · Published 28 Aug 2020
- Shattering the Dream - When a Job Offer Becomes a Zero-Day AttackCheck Point · Published 11 Aug
- Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution EcosystemCheck Point · Published 3 Jun
- Cavern Manticore: Exposing Iran-Linked Modular C2 FrameworkCheck Point · Published 6 Jul
On the same topics
- Ragnar LoaderPRODAFT · Added 18 Oct
- Netwalker malware: What it is, how it works and how to prevent itInfosec Institute · Published 29 Jul 2020
- How CrowdStrike Analyzes macOS Malware to Optimize Automated DetectionCrowdStrike · Published 6 May 2022
- Disrupting Fox Tempest: A cybercrime service that turned “verified” software into a pathway for ransomwareMicrosoft · Published 19 May
