Troll Information Stealer: Threat Analysis

Troll, a malicious software written in the Go language, has emerged as a potent threat, specializing in the stealthy extraction of sensitive information from compromised computers. This article delves into the intricacies of Troll, shedding light on its actions, consequences, and the imperative need for robust cybersecurity measures.

Understanding Troll Malware

1. Infiltration Strategy: Troll adopts a deceptive facade, initially disguising itself as a benign security program installation file. Users unknowingly download and open this file, thinking it’s a legitimate security program, ultimately introducing the malware onto their systems.
2. Operational Sequence: Upon activation, Troll undertakes a precise sequence of actions to obscure its presence, including the removal of the “ChromeUpdateTaskMachineUAC” scheduler. This strategic move aims to avoid detection and highlights the malware’s sophisticated approach.
3. Data Gathering and Encryption: Troll systematically collects sensitive information from the infected system, encompassing MAC addresses, directory paths, configuration details, SSH credentials, FileZilla configurations, and more. This pilfered data is encrypted and transmitted to designated Command and Control (C&C) servers.
4. Espionage Activities: The malware exhibits a focus on high-value targets, possibly within governmental or public institutions, by targeting administrative certificates, specifically the GPKI folder on the C drive. This suggests a calculated campaign with espionage objectives.
5. Browser Data Theft: Troll employs a tool named HackBrowserData to extract information from web browsers like Chrome and Firefox. This includes data such as cookies, browsing history, and browser add-ons, which is encrypted and sent to the attackers.
6. Desktop Screenshots: The malware is equipped to capture desktop screenshots, further enhancing its arsenal of pilfered information. These encrypted snapshots contribute to the extensive reservoir directed to the Command and Control (C&C) server.

Detection Names and Similar Threats

1. Detection Names: Troll is identified by various antivirus solutions, with detection names including Win64:Evo-gen [Trj], TR/Redcap.sbpqu, A Variant Of Win64/Kimsuky.M, Trojan-PSW.Win64.BroPass.cku, Trojan:Win64/TrollAgent.C!dha, and more.
2. Similar Threats: Comparable information stealers like Solan, Nightingale, and Rage operate with stealthy infiltration tactics, aiming to compromise user privacy and extract sensitive data.

Infiltration Mechanism

Troll initiates its infection through users visiting a specific Korean website. This site redirects them to a deceptive security program download page, where the malware poses as TrustPKI or NX_PRNMAN security program installation files from SGA Solutions. Users, thinking they are installing legitimate security software, unwittingly introduce Troll onto their systems.

Prevention and Removal Guide

1. Preventive Measures: Exercise caution while visiting websites, especially those with suspicious redirects. Avoid downloading software from untrusted sources, and scrutinize the legitimacy of security programs before installation.
2. Removal Steps: Manual removal of Troll involves identifying and deleting related files, but caution is advised. Regularly update and run legitimate antivirus software for a comprehensive scan and removal of potential threats.

Conclusion

Troll stealer epitomizes a sophisticated cyber threat, orchestrating covert operations to steal sensitive information. The multifaceted nature of its attacks underscores the importance of cybersecurity vigilance, including preventive measures and regular system scans, to thwart its impact and ensure a secure computing environment.