Loading malware…
TrickBot is a modular Windows malware family best known as a banking trojan that evolved into a broad criminal platform for credential theft, post-compromise operations, and malware delivery. Initially associated with online banking fraud, it later became a major loader and access-enablement framework used to deploy additional payloads, including ransomware and other follow-on malware. The malware has long been linked to the TrickBot criminal syndicate and to operators overlapping with Conti and related cybercrime ecosystems.
TrickBot is designed as a flexible, extensible platform with modules supporting credential theft, persistence, lateral movement, and post-exploitation. Reported behaviors include modification of Windows Registry settings, use of encoded PowerShell for persistence and lateral movement, and process injection techniques such as process hollowing and Thread Local Storage callback manipulation. Samples have also used direct native API calls and anti-analysis measures including API hammering to delay or overwhelm sandbox instrumentation before unpacking and injecting into legitimate Windows processes.
Operationally, TrickBot has been used both as a primary banking trojan and as infrastructure for second-stage attacks. It has been associated with delivery chains involving other malware, notably Emotet as an upstream downloader. The broader TrickBot ecosystem has also included Anchor, a DNS-based command-and-control toolset, including a Linux variant that functions as a lightweight backdoor and dropper while maintaining persistence and supporting cross-platform propagation into Windows environments.
TrickBot has been tied to financially motivated intrusion activity against enterprises and other organizations, and its operators have been connected by researchers and law enforcement to major ransomware operations including Conti and Ryuk. Over time, the family exemplified the shift of former banking malware crews toward loader services, network intrusion support, and ransomware enablement.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
TabDll – Uses the EternalRomance exploit (CVE-2017-0147) to spread via SMBv1. | TrickBot is a modular banking trojan that targets sensitive information and acts as a dropper for other malware. Since June 2019, the MS-ISAC is observing an increasingly close relationship between initial TrickBot infections and eventual Ryuk ransomware attacks.
In August, Microsoft Threat Intelligence Center (MSTIC) identified a small number of attacks (less than 10) that attempted to exploit a remote code execution vulnerability in MSHTML using specially crafted Microsoft Office documents. These attacks used the vulnerability, tracked as CVE-2021-40444, as part of an initial access campaign that distributed custom Cobalt Strike Beacon loaders. | Additionally, some of the infrastructure that hosted the oleObjects utilized in the August 2021 attacks abusing CVE-2021-40444 were also involved in the delivery of BazaLoader and Trickbot payloads — activity that overlaps with a group Microsoft tracks as DEV-0193.
TrickBot utilizes EternalBlue and EternalRomance exploits for lateral movement in the modules wormwinDll, wormDll, mwormDll, nwormDll, tabDll.
Windows Office Product Spawned Uncommon Process ... CVE-2023-21716 Word RTF Heap Corruption, CVE-2023-36884 Office and Windows HTML RCE Vulnerability ...
18 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
this backdoor is using now by ITG23 cyber criminals who developed Conti Ransomware and trickbot
The threat cluster relies heavily on Remote Monitoring and Management (RMM) tools, unlike UNC2686 which deployed BAZARLOADER variants as well as TRICKBOT, URSNIF, and SILENTNIGHT.
WithSecure found connections between GREYVIBE’s tooling and both the TrickBot gang and UAC-0098, a group previously linked to Russian cybercriminal networks.
The most notorious among these are campaigns involving banking Trojans such as Dridex and TrickBot, ransomware such as Clop/Cryptomix and MINEBRIDGE...
...sanctions against the Russian hackers allegedly connected to a single network behind the Conti and Ryuk ransomware variants, as well as the infamous Trickbot banking trojan...
Threat actors use BazarLoader and Trickbot to deploy the Ryuk or Conti ransomware, while IcedID has been used in the past to deploy the now-defunct Maze and Egregor ransomware infections.
36 distinct techniques documented for this family, organized by ATT&CK tactic.
Variations include malware traps to safely ingest and sequester potential malware files or sinkholes to redirect traffic from malicious domains to defender-controlled servers, severing the connection between compromised machines and attacker command-and-control infrastructure.
Upon execution it installs itself as a cron job, determines the public ip for the host and then begins to beacon via DNS queries to its C2 server.
A typical encoded PowerShell command looks like this: powershell.exe -EncodedCommand <Base64String>
PowerShell has become a favored tool for attackers due to its powerful capabilities and deep integration within Windows environments.
Finally, when this loop is passed, the sample starts and injects TrickBot (by using directly Nt* APIs) into legit wermgr.exe
Sandworm Team leveraged Microsoft Office attachments which contained malicious macros that were automatically executed once the user permitted them... APT29 has used various forms of spearphishing attempting to get a user to open attachments... DarkGate is distributed through phishing links to VBS or MSI objects requiring user interaction for execution.
Upon execution it installs itself as a cron job, determines the public ip for the host and then begins to beacon via DNS queries to its C2 server.
Trickbot was a sophisticated, modular, multi-functional suite of malware tools which ... (d) used the captured login credentials to fraudulently gain unauthorized access to victims’ online bank accounts at financial institutions
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
The sample also has a Windows version of the malware embedded inside that it can install on remote windows shares and then execute as a service.
Upon execution it installs itself as a cron job, determines the public ip for the host and then begins to beacon via DNS queries to its C2 server.
Finally, when this loop is passed, the sample starts and injects TrickBot (by using directly Nt* APIs) into legit wermgr.exe - the process responsible for Windows error handling and reporting
Thread Local Storage (TLS) callback injection is a technique that entails manipulating pointers within a portable executable (PE) to redirect a process to malicious code before it reaches the code’s legitimate entry point.
Trickbot was a sophisticated, modular, multi-functional suite of malware tools which ... (d) used the captured login credentials to fraudulently gain unauthorized access to victims’ online bank accounts at financial institutions
The sample also has a Windows version of the malware embedded inside that it can install on remote windows shares and then execute as a service.
Threat actors often use encoded PowerShell commands to obfuscate their activities, making detection and analysis more challenging.
Finally, when this loop is passed, the sample starts and injects TrickBot (by using directly Nt* APIs) into legit wermgr.exe - the process responsible for Windows error handling and reporting
Thread Local Storage (TLS) callback injection is a technique that entails manipulating pointers within a portable executable (PE) to redirect a process to malicious code before it reaches the code’s legitimate entry point.
Trickbot was a sophisticated, modular, multi-functional suite of malware tools which ... (d) used the captured login credentials to fraudulently gain unauthorized access to victims’ online bank accounts at financial institutions
The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking whether the current user is an administrator, enumerating user sessions, and gathering account details from compromised hosts.
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
The content notes checks for whether the current user is an administrator or privileged, including 'AsyncRAT can check if the current user of a compromised system is an administrator,' 'Gelsemium has the ability to distinguish between a standard user and an administrator,' and 'Wizard Spider has used whoami to identify the local user and their privileges.'
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
Examples include 'Caterpillar WebShell can obtain a list of user accounts from a victim's machine,' 'DRATzarus can obtain a list of users from an infected machine,' 'Woody RAT can retrieve a list of user accounts and usernames from an infected machine,' and 'TrickBot can identify the user and groups the user belongs to on a compromised host.'
What may be more helpful, though, is the BazarBackdoor APIs and TrickBot command and control server source code that was released, as there is no way to access that info without having access to the threat actor's infrastructure.
The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."
Upon execution it installs itself as a cron job, determines the public ip for the host and then begins to beacon via DNS queries to its C2 server.
APT28 used other victims as proxies to relay command traffic, for instance using a compromised Georgian military email server as a hop point to NATO victims.
ADVSTORESHELL exfiltrates data over the same channel used for C2... Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers... numerous malware and groups sent victim data, files, credentials, or host information over existing C2 channels.
182 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A major cybercriminal malware ecosystem/group tied to ransomware campaigns and large-scale criminal operations, including healthcare and banking targets. The content describes it as central to operations involving multiple ransomware strains and substantial ransom proceeds.
A prolific malware strain whose developers were included in the sanctions; the content does not provide technical behavior beyond identifying it as notable malware.
TrickBot is referenced as a major cybercrime operation connected to Ryuk by law enforcement and researchers.
TrickBot is described as using API hammering and file-write loops to evade sandbox analysis, then injecting itself via direct Nt* APIs into wermgr.exe where it fully unpacks itself.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.