TrickBotMalware
- thetrick
- totbrick
- trickloader
- trickster
- tspy_trickload
A financial Trojan believed to be a derivative of Dyre: the bot uses very similar code, web injects, and operational tactics. Has multiple modules including VNC and Socks5 Proxy. Uses SSL for C2 communication. - Q4 2016 - Detected in wild Oct 2016 - 1st Report 2017 - Trickbot primarily uses Necurs as vehicle for installs.From MISP Galaxy
Last reported 3 months ago, by Infosecurity Magazine11 reports
ATT&CK techniques
6 of 33 · each with the sentence it comes from- T1053.005Scheduled Task
“It stored the task name and executable path in two NTFS Alternate Data Streams (ADS) so subsequent executions rebuilt the same scheduled task rather than creating duplicates.”
- T1684Social Engineering
“…r of the service claimed that Prometheus TDS is an ANTIBOT redirect system designed to send out emails, work with traffic, and for social engineering.”
- T1014Rootkit
“In 2015, Corey Kallenberg and another researcher, Xeno Kovah, presented LightEater, a rootkit that allows to obtain critical data (encryption keys, etc.) through direct access to physical memory and page-by-page searches using signatures.”
- T1542.003Bootkit
“Let's hunt some bootkits”
- T1055.012Process Hollowing
“…esponse commands, including downloading and executing EXE modules, running DLLs through rundll32.exe, injecting into processes via process hollowing or process doppelganging, executing PowerShell through anonymous pipes to cmd.exe and running raw shellcode in memory.”
- T1505.003Web Shell
“The list is uploaded through importing links to web shells.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
11 reports, newest first · the exact sentence from each-
TrickBot Ditches HTTP for DNS Tunneling in Latest Variant“TrickBot Ditches HTTP for DNS Tunneling in Latest Variant”
-
Inside a TrickBot Variant Using DNS Tunneling for C2“Inside a TrickBot Variant Using DNS Tunneling for C2”
-
Making Sense of Alphabet Soup: 16 Security Terms and Acronyms You Should Know“TrickBot”
-
Cleaning the atmosphere“As payload, the email contained a modular banking Trojan called TrickBot.”
-
Prometheus TDS“Analysis revealed that Campo Loader was used at various times to distribute TrickBot and Ursnif/Gozi bankers, etc.”
-
The Brothers Grim“…ng to Group-IB’s Threat Intelligence & Attribution system, Ryuk operators used different commodity malware over time (including Emotet, TrickBot, Bazar, Buer, and SilentNight) to deploy ransomware.”
-
Masters of disguise“…heir own only twice!), which is why there is a growing demand for such an infection method among financially motivated hackers, such as TrickBot operators.”
-
Top Hacker Tradecraft That Caught Our Eye in 2020“We actually saw this recently with TrickBot unleashing a new functionality designed to inspect the UEFI/BIOS firmware of targeted systems, which was dubbed TrickBoot.”
-
Rapid Response: TrickBoot“The TrickBot malware family has sustained its status as a worthy adversary in the world of cybersecurity since 2016.”
-
Tried and True Hacker Technique: DOS Obfuscation“In this blog post we shine the spotlight on an obfuscation technique that we see being used in the latest “100th version” of the TrickBot malware.”
-
Assisted Remediation in Action“This week we had the opportunity to help an MSP partner contain and remediate an Emotet/TrickBot infection that impacted a client with 50+ computers and servers.”
Indicators in its reports
named in the reports above- risks[.]itin 1 report
- westurn[.]inin 1 report
- 8e8a88f8fc968996eed0d7ddd.6ceca998199c18f8d968889898896899789978997.westurn[.]inin 1 report
- f7f2f482f3bc6345a44e4a6d647731aein 1 report
- df527a5c2fbde438…888c7d504c98in 1 report
- 6c677eb2b3ffd288…c440962346f4in 1 report
- 105f652e6b8f31c3…a1fcbb321421in 1 report
- 33c331ededbf8ee9…6aacff458cf5in 1 report
- 3b19a82e1354ac14…08e45024c23din 1 report
- bf80245ba792992f…a29d107c8d3bin 1 report
- 03ec9000b493c716…88c6a1c65ce5in 1 report
- 015e5a1fa9d8151ee51d6e53e187fbb2in 1 report
- 163917ced2d1b330…ec3ea871d517in 1 report
- 63bd614434a70599…a3c4b4db5cafin 1 report
- hxxps://github[.]com/apriegob/GrimAgent/blob/main/IDAPro/IDAPro_string_decryptor.pyin 1 report
- d6ee553f52f20127…73144ef2354din 1 report
- hxxp://ip-api[.]com/csv/?fields=query,countryCodein 1 report
- microsoftupdate[.]topin 1 report
- microsoftsystemcloud[.]comin 1 report
Copy these 19 indicators · defanged
Thanks — we review every report.