Procedure examples

Troll Stealer gathers information from infected systems such as SSH information from the victim's `.ssh` directory. Troll Stealer collects information from local FileZilla installations and Microsoft Sticky Note.

Troll Stealer collects the MAC address of victim devices.

Troll Stealer has been delivered as a VMProtect-packed binary.

Troll Stealer is typically installed via a dropper file that masquerades as a legitimate security program installation file.

Troll Stealer exfiltrates collected information to its command and control infrastructure.

Troll Stealer creates and executes a PowerShell script to delete itself.

Troll Stealer can create and execute Windows batch scripts.

Troll Stealer creates and can execute a BAT script that will delete the malware.

Troll Stealer uses HTTP to communicate to command and control infrastructure.

Troll Stealer encrypts gathered information on victim devices prior to exfiltrating it through command and control infrastructure.

Troll Stealer can collect local system information.

Troll Stealer can enumerate and collect items from local drives and folders.

Troll Stealer can capture screenshots from victim machines.

Troll Stealer performs XOR encryption and Base64 encoding of data prior to sending to command and control infrastructure.

Troll Stealer gathers information from the Government Public Key Infrastructure (GPKI) folder, associated with South Korean government public key infrastructure, on infected systems.

Troll Stealer collects information from Chromium-based browsers and Firefox such as cookies, history, downloads, and extensions.

Troll Stealer is dropped as a DLL file and executed via `rundll32.exe` by its installer.

Troll Stealer creates a mutex during installation to prevent duplicate execution.

Troll Stealer collects all data in victim `.ssh` folders by creating a compressed copy that is subsequently exfiltrated to command and control infrastructure. Troll Stealer also collects key information associated with the Government Public Key Infrastructure (GPKI) service for South Korean government information systems.

Troll Stealer, along with its associated dropper, utilizes legitimate, stolen code signing certificates.

Troll Stealer compresses stolen data prior to exfiltration.

Troll Stealer encrypts data sent to command and control infrastructure using a combination of RC4 and RSA-4096 algorithms.