Shade

Overview

Ransomware:Win32/Shade (also known as Troldesh) is a historically devastating, highly prolific ransomware strain originating from Russia, notorious for its widespread distribution via malspam, its robust encryption, and its use of the Tor network for C2 communication.

Understanding Shade (Troldesh)
For the victim, a Shade infection is catastrophic. Their files are encrypted (appended with extensions like `.xtbl`, `.ytbl`, or `.breaking_bad`), the desktop wallpaper is changed to a ransom note (often in Russian and English), and they are directed to a Tor hidden service to pay the ransom. For incident responders, Shade was a dominant threat from 2014 until its operators surprisingly released all decryption keys and shut down the operation in 2020. Despite this, legacy infections and modified variants still pose a threat.

Execution and Evasion Strategies
Shade was primarily distributed via massive, indiscriminate malspam campaigns containing malicious ZIP attachments or exploit kits. Upon execution, the malware copies itself to `%ProgramData%` or `%AppData%` and establishes persistence via Registry Run keys. It immediately deletes Volume Shadow Copies (`vssadmin.exe`) to prevent recovery. Crucially, Shade reaches out to its C2 server over Tor (or via a hardcoded list of proxies) to obtain a public RSA key. It then encrypts files using AES-256, encrypting the AES key with the RSA public key. If the C2 is unreachable, it uses a hardcoded fallback RSA key. Interestingly, older versions of Shade would download additional malware (like the TeamViewer RAT) if it detected the machine was running accounting software in Russia.

Indicators of Compromise & Impact
The primary indicator is the rapid encryption of files and the presence of `README.txt` ransom notes. EDR platforms will trigger on mass file modifications and the execution of `vssadmin.exe Delete Shadows`. Network logs will show anomalous DNS requests or HTTP traffic attempting to connect to Tor proxies or known Shade C2 IP addresses.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_SHADE {
    meta:
        description = "Detects Shade (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "shade" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Shade Activity
id: a79dc75a13b584baa37f8ec20d944410
status: experimental
description: Detects generic indicators of the shade malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*shade*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately sever the infected endpoint and any mapped network shares from the corporate network to halt the spread of the encryption process.
2. Do NOT reboot the machine immediately; capture a forensic RAM image, as memory analysis may reveal the AES encryption keys if the process is still running.
3. Verify if the specific variant is covered by the public release of the Shade decryption keys (available via NoMoreRansom); decryption may be possible without paying.
4. Initiate disaster recovery protocols using offline, immutable backups if decryption is not possible.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not connect any external drives or network shares to the infected machine, as the ransomware will immediately attempt to encrypt them.
2. Avoid paying the ransom; the official Shade operators have shut down, and payments will likely go to copycats who cannot provide the key.

References & External Analysis

• Search "shade" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Liimpact
• Gatak
• W10Tweak
• Pynamer
• Cnnic

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/shade.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.