S2W Troll Stealer 2024

Troll Stealer gathers information from infected systems such as SSH information from the victim's `.ssh` directory. Troll Stealer collects information from local FileZilla installations and Microsoft Sticky Note.

Troll Stealer collects the MAC address of victim devices.

Troll Stealer has been delivered as a VMProtect-packed binary.

Troll Stealer is typically installed via a dropper file that masquerades as a legitimate security program installation file.

Troll Stealer exfiltrates collected information to its command and control infrastructure.

Troll Stealer creates and executes a PowerShell script to delete itself.

Troll Stealer can create and execute Windows batch scripts.

Troll Stealer creates and can execute a BAT script that will delete the malware.

Troll Stealer uses HTTP to communicate to command and control infrastructure.

Troll Stealer encrypts gathered information on victim devices prior to exfiltrating it through command and control infrastructure.

Troll Stealer can collect local system information.

Troll Stealer can enumerate and collect items from local drives and folders.

GoBear implements SOCKS5 proxy functionality.

Troll Stealer can capture screenshots from victim machines.

Troll Stealer performs XOR encryption and Base64 encoding of data prior to sending to command and control infrastructure.

Troll Stealer gathers information from the Government Public Key Infrastructure (GPKI) folder, associated with South Korean government public key infrastructure, on infected systems.

Troll Stealer collects information from Chromium-based browsers and Firefox such as cookies, history, downloads, and extensions.

Troll Stealer is dropped as a DLL file and executed via `rundll32.exe` by its installer.

Troll Stealer creates a mutex during installation to prevent duplicate execution.

Kimsuky has used malware, such as TRANSLATEXT, to steal and exfiltrate browser cookies.

Troll Stealer collects all data in victim `.ssh` folders by creating a compressed copy that is subsequently exfiltrated to command and control infrastructure. Troll Stealer also collects key information associated with the Government Public Key Infrastructure (GPKI) service for South Korean government information systems.

GoBear uses stolen legitimate code signing certificates for defense evasion.

Troll Stealer, along with its associated dropper, utilizes legitimate, stolen code signing certificates.

Kimsuky has signed files with the name EGIS CO,. Ltd. and has stolen a valid certificate that is used to sign the malware and the dropper.

Troll Stealer compresses stolen data prior to exfiltration.

Troll Stealer encrypts data sent to command and control infrastructure using a combination of RC4 and RSA-4096 algorithms.

Kimsuky has stolen a valid certificate that is used to sign the malware and the dropper.