Bitcoin Ransomware Education – Troldesh

One of the more worrying forms of Bitcoin ransomware to appear is known as Troldesh, or Crypshed. Even though this malware appeared first in Russia – and seemed to stay there – the developers added an English translation to the software in an attempt to spread it in other countries as well. The number of infections has always been relatively low, thankfully, but the ransomware is still in circulation to this very day.

Also read: Bitcoin Ransomware Education – Crypvault

Troldesh Is An Odd Breed of Bitcoin Ransomware

What makes Troldesh a major concern is how security researchers are unsure why ransomware infections spike at certain intervals, whereas the number of infections remain relatively flat for most of the time. One thing’s for sure though: Troldesh became a favorable Bitcoin ransomware for hackers who like to bundle this malware with other exploit kits.

There are two main distributors for the Troldesh Bitcoin ransomware, namely Neclu and Axpergle. Don’t be mistaken in thinking these are two hacker aliases, as they are both exploit kits frequently used among internet criminals in Russia. By infecting websites and compromising the information found on these pages, either exploit kit will be installed and then start downloading Troldesh in the background.

What these two exploit kits really do is check a computer for any vulnerability they can find, and try to expose that weakness. Most antivirus solutions will pick up both Axpergle and Neclu, though, and the risk of infection is mitigated for the average Windows user. However, people who hardly update their antivirus definitions might still be vulnerable to attack.

Related Post

Similar to nearly every other type of Bitcoin ransomware, Troldesh will replace the computer wallpaper and encrypted files on the hard disk. A text file is generated for the encrypted files, which contains instructions on how to proceed with the Bitcoin payment, No official details regarding the ransom amount have been published, so it could be completely random.

Most of the Troldesh infections occured in the Russian Federation – over 80% – followed by Ukraine, Brazil, and Turkey. Other countries were targeted as well, although their infection rates are far too low to be accurately represented in the charts presentd by Technet. Keeping in mind how the ransomware message is displayed in both Russian and English, there was quite a market for this malware.

Luckily for infected users, it does not seem all that hard to get rid of Troldesh. Microsoft Defender, which is installed on every Windows machine these days, can remove the Bitcoin ransomware from the system. Moreover, there is no mention users being unable to restore files from a backup, which seems to be a far preferable alternative to paying the ransom.

Source: Technet

Images credit 1,2

If you liked this article follow us on Twitter @themerklenews and make sure to subscribe to our newsletter to receive the latest bitcoin and altcoin price analysis and the latest cryptocurrency news.

JP Buntinx

JP Buntinx is a FinTech and Bitcoin enthusiast living in Belgium. His passion for finance and technology made him one of the world's leading freelance Bitcoin writers, and he aims to achieve the same level of respect in the FinTech sector.

Share
Published by
JP Buntinx

Recent Posts

Cheems Surge On BSC Network: A Rising Star With Growing Market Value

The Cheems token on the Binance Smart Chain (BSC) is gaining significant momentum, surging by…

4 hours ago

Lester Token Crashes 40% Following Official Announcement

The value of $LESTER plummeted by 40% in the past 24 hours, leaving its market…

4 hours ago

From $30K To Millions: The Wild Journey Of $Quant And Xiaohaige’s Memecoin Stunts

In a bizarre turn of events, a young live-streamer known as Xiaohaige created the memecoin…

4 hours ago

Whale “convexcuck.eth” Makes Bold $CVX Move, Nets Significant Profit Amid Price Surge

The crypto whale known as "convexcuck.eth" has made waves in the DeFi world, spending $2…

4 hours ago

$ELIZA Token Launch Marred By Insider Trading Allegations

The launch of $ELIZA, a token introduced by Andreessen Horowitz (a16z) partner @shawmakesmagic, has sparked…

5 hours ago

Cardano’s Rally Highlights Diverging Moves Among Investors

Cardano ($ADA) has been making waves in the crypto market, breaking away from the altcoin…

5 hours ago