Troldesh

Troldesh, also known as Encoder.858 and Shade, targets Windows OS and it is distributed via the Axpergle and Nuclear exploit kits. First seen in 2015, Troldesh previously provided an email address for victims to contact the attackers in order to negotiate the payment of the ransom. A recently discovered version of Troldesh, however, now uses a payment portal located on the Dark Web and requires victims to use Tor in order to visit the site and submit the ransom amount. It also comes bundled with additional malware named Mexar, downloads the Teamspy bot to obtain remote control of the victim’s machine, and requests URLs of other malware sites from its C2 server. It also scans the victim’s machine for banking files and software in an attempt to extort as much money as possible out of the victim. The original version appended .xbtl or .cbtl to encrypted files. The new version of Troldesh appends either .da_vinci_code or .magic_software_syndicate to encrypted files. The ransom amount varies and one Check Point security researcher reported negotiating a discount from the attackers behind the campaign.

UPDATE 11/28/2016: A newly discovered Shade sample appends .no_more_ransom to encrypted files. 

  • Microsoft provides more information about Troldesh here and here.
     
  • Kaspersky provides a free decryption tool for Troldesh/Shade here with instructions for how to use it here.
     
  • Intel Security provides a free decryption tool for Trodesh/Shade here.
Troldesh example (source: Microsoft Malware Protection Center)

Troldesh example (source: Microsoft Malware Protection Center)