TrickBot turns 100: Latest malware released with new features

guest · Nov 21, 2020

TrickBot turns 100: Latest malware released with new features
November 21, 2020
https://www.bleepingcomputer.com/ne...00-latest-malware-released-with-new-features/

The TrickBot cybercrime gang has released the hundredth version of the TrickBot malware with additional features to evade detection.

TrickBot is a malware infection commonly installed via malicious phishing emails or other malware. When installed, TrickBot will quietly run on a victim's computer while it downloads other modules to perform different tasks.
These modules perform a wide range of malicious activity, including stealing a domain's Active Directory Services database, spreading laterally on a network, screenlocking, stealing cookies and browser passwords, and stealing OpenSSH keys.
Click to expand...

This latest build was discovered by Advanced Intel's Vitali Kremez, who found that they added new features to make it harder to detect.

With this release, TrickBot is now injecting its DLL into the legitimate Windows wermgr.exe (Windows Problem Reporting) executable directly from memory using code from the 'MemoryModule' project.

"MemoryModule is a library that can be used to load a DLL completely from memory - without storing on the disk first," explains the project's GitHub page.
Click to expand...

According to Kremez, when injecting the DLL, it will do so using Doppel Hollowing, or process doppelganging, to evade detection by security software.

"This technique makes use of transactions, a feature of NTFS that allows to group together a set of actions on the file system, and if any of those actions fails, a complete rollback occurs. [...]" a writeup on this technique by security researcher Francesco Muronie explains.
Click to expand...

guest · Dec 3, 2020

TrickBot adds firmware tool that researchers say could lead to 'bricking' devices
December 3, 2020
https://www.cyberscoop.com/trickbot...detection-ability-eclypsium-bricking-devices/

The malicious software known as TrickBot has morphed again, this time with a module that probes booting process firmware for vulnerabilities, possibly setting the stage for attacks that could ultimately destroy devices, researchers say.

Two cybersecurity companies, Eclypsium and Advanced Intelligence (Advintel), dubbed the TrickBot add-on module “TrickBoot,” since it targets the UEFI/BIOS firmware.
TrickBoot, then, is a “significant step in the evolution of TrickBot,” the researchers say, that could make TrickBot especially pesty.

“Since firmware is stored on the motherboard as opposed to the system drives, these threats can provide attackers with ongoing persistence even if a system is re-imaged or a hard drive is replaced,” they wrote.
Click to expand...

Researchers made the TrickBoot discovery in October from a machine in a honeypot network, which are set up to imitate a real target, said Vitali Kremez, CEO of Advintel.
So far, researchers say they have seen TrickBoot performing reconnaissance in a bid to detect firmware vulnerabilities. But the code has a helper function for commands like, read, write and erase, so its ability to “brick” a device is more than theoretical, said Jesse Michael, principal researcher at Eclypsium.
Click to expand...

Eclypsium: TrickBot Now Offers ‘TrickBoot’: Persist, Brick, Profit

Collaborative research between Advanced Intelligence (AdvIntel) and Eclypsium has discovered that the TrickBot malware now has functionality designed to inspect the UEFI/BIOS firmware of targeted systems. This new functionality, which we have dubbed “TrickBoot,” makes use of readily available tools to check devices for well-known vulnerabilities that can allow attackers to read, write, or erase the UEFI/BIOS firmware of a device.
Click to expand...

guest · Jul 14, 2021

Trickbot improve its VNC module in recent attacks
July 14, 2021
https://securityaffairs.co/wordpress/120090/malware/trickbot-botnet-vnc-module.html

The Trickbot botnet continues to evolve despite the operations conducted by law enforcement aimed at dismantling it. The authors recently implemented an update for the VNC module used for remote control over infected systems.

Bitdefender researchers spotted a new version of Trickbot’s VNC module (vncDLL) which was employed in attacks aimed at high-profile targets.

“In May 2021, our systems started to pick up an updated version of the vncDll module that Trickbot uses against select high-profile targets. This module, known as tvncDll, is used for monitoring and intelligence gathering. It seems to be still under development, since the group has a frequent update schedule, regularly adding new functionalities and bug fixes.” states the report published by BitDefender.
The Trickbot module updated0by the authors is called tvncDLL and is used by the botnet to monitor the victim’s activity and information gathering. The module appears to be under development and was frequently updated since its discovery on May 12.
Click to expand...

Experts also documented an option dubbed Native Browser that adds a password-stealing functionality and which is in active development.
The report published by BitDefender also includes Indicators of compromise for the recent infections.
Click to expand...

Bitdefender: Trickbot Activity Increases; new VNC Module On the Radar

In addition to upgraded modules, Bitdefender has noted a significant increase in command-and-control centers deployed around the world.
This new research focuses on an updated VNC module, which includes new functionalities for monitoring and intelligence gathering.

A complete analysis of the new component can be found in the researcher paper available below.
Click to expand...

guest · Dec 6, 2021

TrickBot phishing checks screen resolution to evade researchers
November 26, 2021

The TrickBot malware operators have been using a new method to check the screen resolution of a victim system to evade detection of security software and analysis by researchers.

Last year, the TrickBot gang added a new feature to their malware that terminated the infection chain if a device was using non-standard screen resolutions of 800x600 and 1024x768.
In a new variation spotted by threat researchers, the verification code has been added to the HTML attachment of the malspam delivered to the potential victim.
Click to expand...

A borrowed trick
Researchers usually analyze malware in virtual machines that come with certain particularities - especially on default configurations - such as running services, name of the machine, network card, CPU features, and screen resolution.

Recently, TheAnalyst - a threat hunter and member of the Cryptolaemus security research group, found that the HTML attachment from a TrickBot malspam campaign behaved differently on a real machine than on a virtual one.
Click to expand...

Security researcher MalwareHunterTeam found in March this year a phishing kit that included code for checking the system's screen resolution.
Since then, the researcher told BleepingComputer that he saw the tactic being used multiple times in various phishing campaigns as a means to avoid investigators.

This may also be the first time malware uses an attachment to run a screen resolution check rather than doing it on the landing page serving the malware executable.
Click to expand...

Log in or Sign up

TrickBot turns 100: Latest malware released with new features

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

TrickBot turns 100: Latest malware released with new features

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches