TrickBot Targets PayPal, Salesforce.com

itman · Jun 18, 2017

The financial trojan TrickBot, the successor to Dyre, has expanded its targets beyond banks to include PayPal, the US-based payment processing giant, and two customer relationship management (CRM) SaaS providers.

The CRM targets were Salesforce.com and an auto sales CRM developed by Reynolds & Reynolds in the US.

According to F5 researchers, this branching out could be because of the potential for collecting valuable user data that could enhance phishing campaigns. TrickBot’s consistent initial attack pattern is to use email spam.
Click to expand...

https://www.infosecurity-magazine.com/news/trickbot-targets-paypal/

Minimalist · Jul 21, 2017

The Trickbot banking Trojan is now targeting U.S. banks in new spam campaigns fueled by the prolific Necurs botnet. The malware has grown more potent with the introduction of a customized redirection method as part of its attacks.

IBM X-Force and Flashpoint both recently spotted new Trickbot activity and independently published research on their findings this week.
Click to expand...

https://threatpost.com/trickbot-malware-now-targets-us-banks

itman · Aug 3, 2017

TrickBot Targets Outlook, Browser Data

Soon after being found to have worm-like spreading capabilities, the TrickBot banking Trojan has expanded its attack surface to target Outlook and Web browsing data.

Independent researcher and programmer Hasherezade now reveals that the malware authors have added new modules to their creation and might have also added new developers to its team. A newly observed Outlook.dll module, for example, is written in Delphi, unlike most of the components, which are written in C++.

The security researcher says that the current run comes with 5 modules: SystemInfo.dll and loader.dll (injectDll32), which have been observed in TrickBot since the very beginning, mailsearcher.dll, added in December 2016, and two modules that haven’t been observed before, namely module.dll and Outlook.dll.

According to Hasherezade, module.dll/importDll32 is written in C++ and compiled with Qt5 and OpenSSL. It also incorporates SQLite. The compilation timestamp suggests it was written in May 2017.

The module was designed to steal data from the browsers, including Cookies, HTML5 Local Storage, Browsing History, Flash LSO (Local Shared Objects), and URL hits, among other info. The module is bulky and doesn’t hide its intentions.

Written in Delphi, the Outlook.dll module contains a hardcoded configuration that follows a pattern typical for TrickBot modules. Designed to steal data saved by Microsoft Outlook, the module opens relevant registry keys, then attempts to retrieve saved credentials.
Click to expand...

http://www.securityweek.com/trickbot-targets-outlook-browser-data

itman · Sep 5, 2017

Banking Trojan Now Targets Coinbase Users, Not Just Banking Portals

The TrickBot banking trojan has added support for stealing funds stored in Coinbase.com accounts, according to a recent version spotted in a distribution campaign last week.

TrickBot adds support for targeting cryptocurrency users

August's update was as juicy as the last two months. According to TrickBot samples discovered by Forcepoint security researchers, TrickBot includes a section in its configuration files that instructs it to overlay a fake login page whenever the user visits Coinbase.com in his browser.
Click to expand...

https://www.bleepingcomputer.com/ne...gets-coinbase-users-not-just-banking-portals/

Minimalist · Nov 2, 2018

Trickbot Malware Now Also Steals Passwords From Apps, Web Browsers

Once known as a run-of-the-mill banking trojan with phishing abilities, Trickbot has been upgraded lately with new malware modules designed to expand its capabilities and allow the actors behind it to collect even more data from compromised machines.
Click to expand...

https://news.softpedia.com/news/trickbot-malware-now-also-steals-passwords-523571.shtml

guest · Nov 17, 2018

Minimalist said: ↑

Trickbot Malware Now Also Steals Passwords From Apps, Web Browsers

https://news.softpedia.com/news/trickbot-malware-now-also-steals-passwords-523571.shtml
Click to expand...

A new version also steals the Windows Problem History:
trickbot via fake Lloyds Bank “Important : please review attached document(s) “
November 16, 2018
https://myonlinesecurity.co.uk/tric...k-important-please-review-attached-documents/

This example is today’s latest spoof or imitation of a well-known company, bank or public authority delivering Trickbot banking Trojan. The email with the subject of “Important : please review attached document(s) ” pretends to come from Lloyds Bank but actually comes from “donotreply@lloydsbankdocs.com” which is a look-a-like [...]

There are also changes to the stolen information that Trickbot exfiltrates from the victim’s computer. As well as passwords, browsing history, bank and other financial data & logons etc they are now reading & stealing the reliability data database & information from C:\ProgramData\Microsoft\RAC\

They can use the massive amounts of data from that to perform a multitude of other nefarious tasks on the infected computer. It is very worrying already the amount of date we all send back to Microsoft about the computer and the way we use & interact with it.
Click to expand...

itman · Nov 17, 2018

mood said: ↑

trickbot via fake Lloyds Bank “Important : please review attached document(s) “
Click to expand...

If everyone did the following article mitigation recommendation, malware like this would be a moot point.

All modern versions of word and other office programs, that is 2010, 2013, 2016 and 365, should open all Microsoft office documents that is Word docs, Excel spreadsheet files and PowerPoint etc that are downloaded from the web or received in an email automatically in “protected view” that stops any embedded malware, macros and DDE “exploit /Feature” and embedded ole objects from being displayed and running. Make sure protected view is set in all office programs to protect you and your company from these sorts of attacks and do not over ride it to edit the document. If the protected mode bar appears when opening the document DO NOT follow the advice they give to enable macros or enable editing to see the content. The document will have a warning message, but you will be safe.
Click to expand...

Minimalist · Dec 1, 2018

Brand New Bag? TrickBot Malware Adds POS Data Collection Module

Close on the heels of TrickBot’s recent pwgrab32 password-grabbing module, the new variant scans for indications that infected devices are connected to POS-capable services and machines, according to Trend Micro. It’s worth noting that while the malware collects data about the type and distribution of POS systems, at the time of the Trend Micro report TrickBot wasn’t yet grabbing credit card or banking information.
Click to expand...

https://securityintelligence.com/ne...kbot-malware-adds-pos-data-collection-module/

guest · Jan 31, 2019

Trickbot with multiple changes via fake Chase JP Morgan incoming confirmation
January 31, 2019
https://myonlinesecurity.co.uk/tric...a-fake-chase-jp-morgan-incoming-confirmation/

Trickbot is back with a vengeance. I have seen a couple of mentions on Twitter earlier this week but haven’t actually been able to find any copies myself. However that all changed last night with several emails to various email addresses on my server. These are targeted at the USA rather than the UK, but I expect the UK targeting to resume very soon.

This example is today’s latest spoof or imitation of a well-known company, bank or public authority delivering Trickbot banking Trojan.
We can see quite a few changes in these versions.

Firstly the powershell script in side the macro is now Base64 encoded, but it is not normal base64, it looks obfuscated or encrypted. This makes it more difficult for a researcher to find the download URLs but online sandboxes can manage this very easily. [...]
There definitely appears to be a difference between running this on a W7 sandbox & a W8.1 sandbox or a W10 sandbox online and whether you use a MITM packet inspection on the sandbox connections.
Click to expand...

Make sure protected view is set in all office programs to protect you and your company from these sorts of attacks and do not over ride it to edit the document. If the protected mode bar appears when opening the document DO NOT follow the advice they give to enable macros or enable editing to see the content.

Be aware that there are a lot of other dodgy word docs spreading that WILL infect you with no action from you, if you are still using an out dated or vulnerable version of word.
At this time, these malicious macros only infect windows computers. They do not affect a Mac, IPhone, IPad, Blackberry, Windows phone or Android phone.
Click to expand...

guest · Feb 13, 2019

Trickbot Adds Remote Application Credential-Grabbing Capabilities to Its Repertoire
February 12, 2019
https://blog.trendmicro.com/trendla...tial-grabbing-capabilities-to-its-repertoire/

In November 2018, we covered a Trickbot variant that came with a password-grabbing module, which allowed it to steal credentials from numerous applications.
Its authors clearly aren’t done updating Trickbot — we recently found a new variant that uses an updated version of the pwgrab module that lets it grab remote application credentials.

However, as these attachments usually go, this macro is malicious and will download and deploy Trickbot on the user’s machine once activated.
VNC - To grab VNC credentials, the pwgrab module searches for files using the “*.vnc.lnk” affix that are located in the following directories: [...]
PuTTY - To retrieve the PuTTY credentials, it queries the registry key Software\SimonTatham\Putty\Sessionsto identify the saved connection settings, which allows the module to retrieve information such as the Hostname and Username, and Private Key Files used for authentication.
RDP - Its third function related to RDP uses the CredEnumerateA API to identify and steal saved credentials. It then parses the string “target=TERMSRV” to identify the hostname, username, and password saved per RDP credential.
Click to expand...

guest · Mar 25, 2019

TrickBot Creators Collaborate With BokBot to Conduct Man-in-the-Middle Attacks
March 25, 2019
https://securityintelligence.com/ne...-bokbot-to-conduct-man-in-the-middle-attacks/

On March 17, Crowdstrike discovered a BokBot proxy module called shadDll in conjunction with TrickBot. The code for the two banking Trojans is 81 percent similar, the researchers said, which means the proxy module can be seamlessly integrated into TrickBot’s extensible, modular framework.

The researchers have attributed the BokBot Trojan to a cybercriminal group called Lunar Spider, while TrickBot is believed to have been created by a group called Wizard Spider.
X-Force researchers also discovered that TrickBot has been used to steal cryptocurrency, and distribution of the BokBot module may make it even more popular.
Click to expand...

guest · Mar 29, 2019

Technical Analysis of a Banking Trojan Malware
March 28, 2019
https://www.sentinelone.com/blog/trickbot-technical-analysis-banking-trojan-malware/

[...] Based on what we see in VT, we can see that the file has a reputation for being malicious and that some of the detections are reporting it as a sample of the TrickBot banking trojan.
What Happens When Trickbot Executes?
So what happens when we execute it? To start with, there are a few interesting things that Procmon can show us. Initially, the malware duplicates itself to a new directory which is hidden in the User’s Roaming Profile

Then, the payload targets and disables Windows Defender:
[...] the Trickbot malware creates and populates registry keys for ‘CertificateTransparencyEnforcementDisabledForUrls’ [...] This allows SSL encryption levels to be downgraded to less secure algorithms without the browser raising a big red flag.
Click to expand...

guest · Apr 8, 2019

Spam Campaigns Spread TrickBot Malware with Tax Lure
August 8, 2019
https://threatpost.com/spam-campaigns-spread-trickbot-malware-with-tax-lure/143551/

Hackers pushing the TrickBot banking trojan are exploiting tax season by pushing malicious Microsoft Excel spreadsheet documents via spam campaigns.

Researchers said that they discovered the malware in three different campaigns since Jan. 27, 2019. These campaigns target victims with emails pretending to be from large accounting, tax and payroll services firms – including ADP and Paychex. However, in reality the messages were carrying malicious Microsoft Excel attachments that eventually download and execute TrickBot trojan.

“Once TrickBot is installed on a potentially vulnerable device and can reach other devices on the network, it can further spread and pivot,” researchers with IBM X-Force warned in a Monday analysis
Once downloaded, TrickBot steals “as much data possible,” researchers said – including banking credentials and more.
Click to expand...

guest · May 20, 2019

Trickbot variant using fake shipping info in the wild
May 20, 2019
https://www.scmagazine.com/home/sec...variant-using-fake-shipping-info-in-the-wild/

A new Trickbot variant has appeared on Trend Micro’s radar that uses a URL redirect in a spam email as a tactic to sidestep spam filters set to block the malware.
The spam email is well-constructed and legitimate appearing with content that indicates a processed order is ready for shipping and includes a shipping number and additional details to convince the recipient to click on the link.

“In this particular case, the variant used Google to redirect from the URL hxxps://google[.]dm:443/url?q=<trickbot downloader>, whereby the URL in the query string, url?q=<url>, is the malicious URL that the user is redirected to,” Trend Micro wrote.
Once the link is clicked the victim is taken to a page that looks like an order review page. At this time a .zip file is downloaded containing Visual Basic Script, which is the Trickbot downloader. Once executed, Trickbot then goes to work.
Click to expand...

guest · May 22, 2019

Ohio school sends students home because of Trickbot malware infection
TrickBot infections impacted, PC fleet, phone and HVAC systems
May 21, 2019
https://www.zdnet.com/article/ohio-school-sends-students-home-because-of-trickbot-malware-infection/

But, surprise, surprise, the malware infection was not a ransomware attack, as most infosec experts would have expected, but a banking trojan.
More precisely, the malware that brought down the school district's IT systems is named Trickbot, according to a Facebook post published Monday by officials from the Coventry Local School District in Ohio.
INFECTED LAST WEEK, BUT NOT BY A STUDENT
Officials said they were infected last week, but only discovered the infection on Friday. Despite working to restore impacted systems, the school district's IT staff were not able to finish their recovery efforts over the weekend.

"It seemed like once one machine was infected, 10 more were right behind it," Blough told News5 Cleveland. "Soon the whole network essentially stopped functioning."
In a separate interview with the Akron Beacon Journal, Blough also said the malware brought down the school's phone and HVAC systems.
Click to expand...

guest · Jul 3, 2019

Trickbot Trojan Now Has a Separate Cookie Stealing Module
July 3, 2019
https://www.bleepingcomputer.com/ne...an-now-has-a-separate-cookie-stealing-module/

Trickbot trojan now comes with a separate module for stealing browser cookies, threat researchers found on Tuesday, marking new progress in the malware's development.

The new module is dubbed Cookie Grabber and its purpose is only to steal cookies - bits of text that websites save in the browser for various purposes like remembering the login state, the website preferences, personalized content; or for tracking a user's browsing activity.
Trickbot's new module was first spotted on June 2 by malware researcher Brad Duncan during a Trickbot infection that delivered the file "cookiesDLL64."

Duncan published a short post with details about the traffic generated by Trickbot's latest module and the artifacts associated with it, as found on an infected Windows host. and the artifacts found on an infected Windows host that had the browser stealing module.
Click to expand...

guest · Jul 9, 2019

Trickbot Trojan Gets IcedID Proxy Module to Steal Banking Info
July 9, 2019
https://www.bleepingcomputer.com/ne...ts-icedid-proxy-module-to-steal-banking-info/

Trickbot trojan shows that it continues to evolve as its operators have started to deploy a custom proxy module to victims. This new component is derived from BokBot's code for web injection attacks and works with popular web browsers.

The infection chain starts with a malicious Office Word document, which deploys a PowerShell script to download the Ursnif trojan. The host compromised in this way also receives the Trickbot variant with the BokBot/IcedID proxy module that can intercept and modify web traffic.
This new variant was found on a system infected on July 5 being dropped separately as "shadnewDll" and it comes with its own configuration file.

Security researcher Vitali Kremez looked at the component and determined that it can hook to Google Chrome, Mozilla Firefox, Internet Explorer, and Microsoft Edge.
The malicious add-on acts as a local proxy server positioned between the client and the online banking service. From this spot, it can insert in the connection a fake template for the bank requested by the user and collect financial information.
Click to expand...

guest · Jul 12, 2019

TrickBot malware learns how to spam, ensnares 250M email addresses
July 12, 2019
https://techcrunch.com/2019/07/12/trickbot-spam-millions-emails/

Old bot, new tricks.
TrickBot, a financially motivated malware in wide circulation, has been observed infecting victims’ computers to steal email passwords and address books to spread malicious emails from their compromised email accounts.

It’s highly adaptable and modular, allowing its creators to add in new components.
With these new spamming capabilities, the malware — which researchers are calling “TrickBooster” — sends malicious from a victim’s account then removes the sent messages from both the outbox and the sent items folders to avoid detection.

If a victim’s computer is already infected with TrickBot, it can download the certificate-signed TrickBooster component, which sends lists of the victim’s email addresses and address books back to the main server, then begins its spamming operating from the victim’s computer.
The malware uses a forged certificates to sign the component to help evade detection, said Caspi.
Click to expand...

Deep Instinct: TrickBooster – TrickBot’s Email-Based Infection Module

guest · Jul 17, 2019

Targeted TrickBot activity drops 'PowerBrace' backdoor
July 11, 2019
https://technical.nttsecurity.com/post/102fnog/targeted-trickbot-activity-drops-powerbrace-backdoor

The use of PowerBrace is noteworthy as there are only a few samples available in public and it has been attributed to other major threat actors, indicating previously unknown collaborations.
Distribution method
NTT Security observes that the threat actor behind TrickBot mainly uses two distribution methods to deliver the malware. The first one is traditional email campaigns [...]
The other increasingly popular way is to collaborate with external successful malware distributors such as the group behind Emotet.
PowerBrace backdoor deployment
During May 2019, NTT Security’s Security Operation Center (SOC) observed the TrickBot threat actor deploying the Powershell backdoor PowerBrace towards a small subset of victims.

The backdoor will delete itself at execution indicating it to be deployed only when needed and not to be used as a persistence mechanism
Our working theory is that PowerBrace is used as a tool during intrusions in order to quickly perform tasks such as file transfers, command execution, additional payload deployments etc.
Click to expand...

The interesting point to make here is that TrickBot has dropped PowerBrace, a backdoor which seems to be created either by Lazarus or TA505 group.

Does this indicate that the TrickBot group is collaborating with Lazarus? Or does the TrickBot group collaborate with TA505 which in turn collaborates with Lazarus? Can it be the case that the author of PowerBrace actually is TA505 and not Lazarus?
The uncertainties are many in how these groups relate to each other.
Click to expand...

Minimalist · Jul 19, 2019

Fake Office 365 Site Pushes Trickbot Trojan as Browser Update

Attackers have created a fake Office 365 site that is distributing the TrickBot password-stealing Trojan disguised as Chrome and Firefox browser updates.
Click to expand...

https://www.bleepingcomputer.com/ne...ite-pushes-trickbot-trojan-as-browser-update/

Minimalist · Jul 30, 2019

New TrickBot Version Focuses on Microsoft's Windows Defender

A new version of the TrickBot banking Trojan continues its evolution of targeting security software in order to prevent its detection and removal. In this new version, TrickBot has set its sights on Windows Defender, which for many people is the only antivirus installed on a Windows 10 machine.
Click to expand...

https://www.bleepingcomputer.com/ne...rsion-focuses-on-microsofts-windows-defender/

guest · Aug 6, 2019

Latest Trickbot Campaign Delivered via Highly Obfuscated JS File
August 5, 2019
https://blog.trendmicro.com/trendla...aign-delivered-via-highly-obfuscated-js-file/

We have been tracking Trickbot banking trojan activity and recently discovered a variant of the malware (detected by Trend Micro as TrojanSpy.Win32.TRICKBOT.TIGOCDC) from distributed spam emails that contain a Microsoft Word document with enabled macro.

In a sample email, the spam purports to be a subscription notification involving advertising providers, even telling the user that it submitted an application for a three-year subscription and settled a sum of money with the sender.
It ends by prompting the user to see the attached document for all the settlement and subscription information. The document in question contains the malicious script.

The JS file also checks for running processes — what’s particularly notable is the malware’s anti-analysis or evasion characteristic, which checks for the total number of all the running processes in the victim’s machine, which means it will not proceed with its execution if there are not enough processes running.
If the running processes are under 1,400 characters (length of the string), the malware assumes it to be an indicator that it is running in a virtual or sandbox environment.
Click to expand...

guest · Aug 28, 2019

New TrickBot Variant Targets Verizon, T-Mobile, and Sprint Users
August 28, 2019
https://www.bleepingcomputer.com/ne...nt-targets-verizon-t-mobile-and-sprint-users/

A new Trickbot Trojan variant was spotted while focusing on stealing PIN codes from Verizon Wireless, T-Mobile, and Sprint users, marking a new step in this malware's development.
While in the beginning it only came with banking Trojan capabilities designed to collect and deliver as much sensitive data as possible to its masters, it is now also become a popular malware dropper capable of infecting compromised machines with other malware families.
Users of U.S. mobile carriers under attack
Secureworks Counter Threat Unit (CTU) researchers were the ones who spotted this new TrickBot version during August 2019 after discovering new dynamic webinjects targeting U.S. mobile users' information.

"When a victim navigates to the website of one of these organizations, the legitimate server response is intercepted by TrickBot and proxied through a command and control (C2) server," explain the researchers.
Besides injecting the extra PIN request form within its targets' login pages, this variant of TrickBot also injects code designed to capture and exfiltrate the harvested username, password, and PIN to its C2 server.
Click to expand...

guest · Aug 30, 2019

TrickBot Bypasses Secure Email Gateway Using Google Docs Phishing
August 30, 2019
https://www.bleepingcomputer.com/ne...ure-email-gateway-using-google-docs-phishing/

The Google Docs online word processor is being used by attackers to disseminate TrickBot banking Trojan payloads to unsuspecting victims via executables camouflaged as PDF documents.
The phishing messages delivered via this malspam campaign use legitimate messages generated by sharing a Google Docs document with the targets, containing a fake 404 error message and a link to the malicious payloads.
TrickBot payloads delivered via Google Docs
By using legitimate Google Docs document sharing emails and landing pages, the attackers successfully bypassed a secure email gateway designed to monitor emails and block such attacks in their tracks as Cofense's research team discovered.
Click to expand...

Cofense: Trickbot Is Using Google Docs to Trick Proofpoint’s Gateway

guest · Sep 4, 2019

TrickBot Trojan switches to stealthy Ostap downloader
September 4, 2019
https://www.computerweekly.com/news/252470091/TrickBot-Trojan-switches-to-stealthy-Ostap-downloader

At least one of the three cyber attack groups operating the TrickBot modular banking Trojan has switched to a commodity JavaScript downloader to bypass security controls, according to researchers.

Due to Ostap’s use in other malware campaigns, researchers said this suggested it was a commodity downloader widely available to multiple threat actors, including TrickBot’s operators.
However, the use of Ostap marks a departure from previous TrickBot campaigns that used obfuscated command shell and PowerShell commands that were triggered by VBA AutoOpen macros to download payloads.

“The Ostap samples analysed generated incomplete traces in two different public sandboxes and neither downloaded their respective TrickBot payloads. Moreover, a sample that was uploaded to VirusTotal had a low detection rate of 11% when it was first uploaded, suggesting that Ostap is effective at evading most antivirus engines,” he wrote in a blog post.
Click to expand...

Bromium: Deobfuscating Ostap: TrickBot’s 34,000 Line JavaScript Downloader

Log in or Sign up

TrickBot Targets PayPal, Salesforce.com

itman Registered Member

Minimalist Registered Member

itman Registered Member

itman Registered Member

Minimalist Registered Member

guest Guest

itman Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

TrickBot Targets PayPal, Salesforce.com

itman Registered Member

Minimalist Registered Member

itman Registered Member

itman Registered Member

Minimalist Registered Member

guest Guest

itman Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches