Trickbot

TrickBot is an advanced banking Trojan that attackers can use to steal payment credentials from the victims. It can redirect the victim to a fake banking cabinet and retrieve credentials typed in on the webpage.

Type
Trojan
Origin
Unknown
First seen
1 September, 2016
Last seen
31 March, 2020
Also known as
TrickLoader
Global rank
12
Week rank
18
Month rank
13
IOCs
349

What is TrickBot malware?

TrickBot, AKA TrickLoader, is a banking Trojan – a malware designed to steal banking credentials. It is aimed at corporate and private victims and utilizes techniques such as redirection attacks. It manipulates what the victim sees in the browser and redirects to a bank cabinet webpage, forged by the hackers.

Reportedly, TrickBot has already stolen millions of dollars from banks in the United States of America, England, Australia, New Zealand, Canada, and Germany.

General description of TrickBot

The first versions of this Trojan trojan used to target mostly corporate bank accounts, in particular, aiming at a specific regional banking platform used by American banks.

The malware is thought to be created by the same team of criminals known for developing another dangerous trojan – Dyre which has been active until 2015 and reportedly successfully stolen millions of dollars for the Ryanair airline among others. Dyre rapidly stopped operating in 2015 after Russian authorities seized a group of hackers, however, this connection has never been proven definitively.

It’s speculated that some hackers from the group managed to avoid Russian authorities and came together to create Dyre's successor – TrickBot. This version is supported by the fact that TrickBot’s source code appears to be a rewrite of Dyre, albeit upgraded and refined utilizing C++ as opposed to Dyre which mostly utilized C.

Through its lifespan TrickBot trojan developers have upgraded functionality of the virus multiple times, not only adding new features and improving the banking Trojan but also changing target banks, making their attacks highly unpredictable. Among other updates, TrickBot received support for EternalBlue exploit, thus allowing it to spread over corporate networks. By August 2016 the malware gained email and browser history theft functionality and in September 2016 the virus learned to steal cryptocurrency, by interjecting the normal payment process and stealing the coins when the user fills in personal and payment information on a payment gateway, grabbing the valuable tokens and redirecting them to a wallet that belongs to the hackers.

Trickbot malware analysis

The video created by the ANY.RUN malware hunting service allows us to see the incident as it unfolds.

process graph of trickbot analysis Figure 1: TrickBot’s lifecycle diagram created in ANY.RUN

ANY.RUN is an interactive malware sandbox that not only allows to watch the simulation in a safe environment, but also control it with direct human input when necessary. In addition to video simulation, the service provides a variety of useful tools, such as comprehensive text reports.

text report of trickbot banking trojan analysis Figure 2: A text report generated by ANY.RUN

The artifacts can appear in AppData\Local\Temp and AppData\Roaming directories on a contaminated machine. In addition, the malware is sometimes downloaded to the user PC using a batch file. After achieving persistence the malware can reportedly be found in a winapp folder which is located in AppData\Roaming directory.

The virus utilizes a sophisticated method for infections which allows it to stay undetected by antivirus software. Instead of keeping configuration files locally on the user's machine, TrickBot is able to receive this data from C2 in real-time. Particularly, when a victim heads to one of the target web pages, TrickBot intersects the HTTP response of the website while sending the following information to C2:

  • A complete URL of the target bank website that the user navigates to
  • A whole HTTP query
  • HTML code of the webpage that the victim is trying to view

The C2 server then sends a new HTML markup that includes the malicious parts to the user and instead of visiting a bank account, the user ends up on a forged page.

How to avoid infection by TrickBot?

Since the virus is often distributed in Microsoft Office files, it needs macros or the editing mode in the Microsoft Office to be activated in order to enter an active phase. As long as both macros are deactivated and the editing mode is switched off, the virus will pose no danger to a PC.

Distribution of TrickBot

TrickBot trojan is distributed with malspam and phishing campaigns that are powered by the Necurs botnet, which has become extremely popular among attackers who utilize the malware-as-a-service business model.

Attackers will usually try to threaten and scare the victim in an effort to make the victim read the email and download any attached files. The Trojan itself manages to get on a victim's machine through an Excel document that contains a macro programmed to download and start the execution of the banking Trojan. However, In some of the more recent campaigns, HTML attachments have been included in the emails. Programmed to download Microsoft Office documents, the use of HTML attachments helps to avoid detection by antivirus software. What’s more, In the very last distribution campaigns, the attackers have started utilizing eFax ploys, tricking victims into clicking on VBS extensions that contain the virus.

TrickBot execution process

The given example is an analysis of the executable file that was performed using the ANY.RUN malware hunting service.

After the file was run it immediately launched the command prompt with commands to stop and delete Windows Defender as well as turn off Windows Defender Real-time Protection using PowerShell.

process tree of trickbot execution

The virus then utilized CMSTP.exe to bypass user account control and execute the same commands through an auto-elevated COM interface.

After performing the initial steps, the malware added itself to Task Scheduler, thus ensuring that it will be executed later. After a while Task Scheduler ran the malicious code which in turn started the contaminated svchost.exe processes. The svchost.exe process then started the malicious activity, launching itself and stealing credential data.

process tree of trickbot execution

How to detect Trickbot using ANY.RUN?

This malware creates files that allow to analysts say for sure that this is Trickbot. Open the "Files" tab in the lower part of the task's window and take a look at the created files. Filenames vary according to the bitness of the operating system. You can be sure this is Trickbot if you find these files and folder: systeminfo32 or systeminfo64, injectDll32 or injectDll64 and folder injectDll32_config or injectDll64_config.

files created by trickbot Figure 3: Files created by Trickbot

Conclusion

Clever attack techniques utilized by TrickBot creators make this banking Trojan extremely dangerous both to corporate and personal victims. Once infected, a general person is extremely unlikely to find out about the Trojan and identify that the bank account the user is visiting is, in fact, a forged one.

Thankfully, modern simulation services like ANY.RUN allows professionals to study the threat and deploy appropriate security measures.

IOCs

IP addresses
5.182.210.246
203.176.135.102
195.123.239.67
180.180.216.177
171.100.142.238
195.123.221.53
185.177.59.115
96.9.73.73
212.80.217.220
45.148.120.117
185.20.185.76
51.254.164.244
51.254.164.244
181.129.104.139
170.238.117.187
192.3.247.119
186.159.1.217
51.254.164.245
144.91.80.253
198.8.91.10
Hashes
ac27e0944ce794ebbb7e5fb8a851b9b0586b3b674dfa39e196a8cd47e9ee72b2
37b1c77366dc34b787f076b894fb97e384ffc1ac4212a716cce2446a9aad3b6b
c6b0a61d94bebf61ecb16a34ce9bd7e2aa6afcc29754e0083f33541894dce012
101769673557d866ade8d46936349978999563d39b7485da042c4ab5a9f5dbd0
4b1fec069eba2d48a4bb91d2eb44c1f92bd0ff28ded3f2cdd0efc8f5dd13bdf0
b9d7755c28f33e9023df9fdc240561437cea0a653cdd499b28ddd530ffc6a8ed
8555403fc0f8d6ea93f0b37ff99064d93bbda9de0aacca24ca55afb4b3e71d75
1c622f504dec3386f3738dcb489bd5e51b4bbf1ac0afbf61082bb2e806039d19
16e11c7bf84298a97c05fa7a34c925073188f9f029bd3933d2d6edc3064a5d05
b3c35bd558ef1dc59bd8f2ac2e4ca43366bb3599e2b1f39655a999f13a575e87
b62eff69ab082545b55671f1f8b0dfacb74c45b36d203f002acb6ff5220f5134
cd06cd467ba6c7f253a850450691e8b996f955b69f6fa9ff231f52bfe95fbd18
940e22b6381bc0a717d20978720b22ae1aeab0515ac6787448fee37ea260f36f
6a2b4e418fd9a10e31e119a5899f04c20bc3e7567d7849b9af93e7b5f2f7cd57
67f63b286ba779d86c9a24d62b1bd8ff38fa4f6a208575cb897a157e77b0000c
e3aad26b425b5bb126ebd0e4c5dd9cbbb82bdfd7e388997c4d0ad6904a75304b
d2f9fb11ee5bd539a63f1cc8dcb88795ebaed065cc6bbc57ce016d207a91cf2d
927f6fd1540d76b20303db4f0f26a945821ad98d4c625a81203061d877bae661
096ab081386129f5223752a8c47eab1bffe7a90c04efd8152662e5d36f0cbd12
d8ebbc39392c7eca0c1a255a2716ea2e984b792f5c156d4d0f0a3071db3c4d60
Domains
majul.com
elx01.knas.systems
isns.net
qxq.ddns.net
krupskaya.com
m-onetrading-jp.com
thuocnam.tk
girls4finder.com
www.syneosheallth.com
syneosheallth.com
sttgen.com
caatii.com
mlpaa.com
light4body-fatburn.world
www.bloxsploits.com
fnoetwotb4nwob524o.hk
zkc5kelvin.xyz
store.estau.ru
kh.diecastingprocessing.com
qernafj8493.com

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat and JSocket is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Agent Tesla screenshot
Agent Tesla
agenttesla trojan rat stealer
Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.
Read More
Ave Maria screenshot
Ave Maria
avemaria stealer trojan rat
Ave Maria malware is a Remote Access Trojan that is also called WARZONE RAT. Hackers use it to control PCs of their victims remotely and steal information from infected PCs. For example, they can remotely activate the camera to take pictures of a victim and send them to a control server
Read More
Azorult screenshot
Azorult
azorult trojan rat
AZORult can steal banking information including passwords and credit card details as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.
Read More
Crimson RAT screenshot
Crimson RAT
crimson rat trojan
Crimson is a Remote Access Trojan — a malware that is used to take remote control of infected systems and steal data. This particular RAT is known to be used by a Pakistani founded cybergang that targets Indian military objects to steal sensitive information.
Read More
Danabot screenshot
Danabot
danabot trojan stealer
Danabot is an advanced banking Trojan malware that was designed to steal financial information from victims. Out of the Trojans in the wild this is one of the most advanced thanks to the modular design and a complex delivery method.
Read More