Loading malware…
TrickBot is a modular Windows malware family operated by the cybercrime group Wizard Spider. It has functioned as a payload delivery platform in financially motivated intrusions, including operations that culminated in deployment of Ryuk and Conti ransomware. TrickBot has been distributed through malicious email messages carrying Excel documents with macros. It can use PowerShell to retrieve additional payloads, open documents, and upload data to command-and-control infrastructure. Documented modules include process discovery, and it establishes persistence by creating scheduled tasks. TrickBot was also used in the broader Emotet–TrickBot ransomware-access ecosystem, in which compromised environments were monetized through follow-on malware and ransomware deployment.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
In Microsoft’s December 14, 2021, Patch Tuesday vulnerability release, security patches were released for a high severity zero-day vulnerability impacting the Windows AppX installer. The vulnerability is tracked as CVE-2021-43890 (CVSS: 7.1). Exploitation allows a threat actor to create a malicious file that appears to be a legitimate application. Exploitation in the wild has been observed in the delivery of multiple malware types including: Emotet, Trickbot, and BazarLoader. | Exploitation in the wild has been observed in the delivery of multiple malware types including: Emotet, Trickbot, and BazarLoader.
This campaign used many advanced persistence, lateral movement, and detection evasion measures, including attempts to disable Windows Defender, the use of EternalBlue to spread... spreader_x64.dll: a module that spreads TrickBot by exploiting EternalBlue | TrickBot then steals sensitive information and downloads the Ryuk ransomware.
The botnet is known to exploit a known vulnerability in the Winbox component of MikroTik routers (CVE-2018-14847), enabling the attackers to gain unauthenticated, remote administrative access to any affected device. | The disclosure also coincides with a new report from Microsoft, which revealed how the TrickBot malware has weaponized MikroTik routers as proxies for command-and-control communications with the remote servers, raising the possibility that the operators may have used the same botnet-as-a-service.
the seller offered two types of weaponized Microsoft Office documents (maldocs) to users: one that exploits a known vulnerability in Microsoft Office (CVE-2017-8570) and another that uses a malicious macro.
TabDll – Uses the EternalRomance exploit (CVE-2017-0147) to spread via SMBv1. | TrickBot is a modular banking trojan that targets sensitive information and acts as a dropper for other malware. Since June 2019, the MS-ISAC is observing an increasingly close relationship between initial TrickBot infections and eventual Ryuk ransomware attacks.
In August, Microsoft Threat Intelligence Center (MSTIC) identified a small number of attacks (less than 10) that attempted to exploit a remote code execution vulnerability in MSHTML using specially crafted Microsoft Office documents. These attacks used the vulnerability, tracked as CVE-2021-40444, as part of an initial access campaign that distributed custom Cobalt Strike Beacon loaders. | Additionally, some of the infrastructure that hosted the oleObjects utilized in the August 2021 attacks abusing CVE-2021-40444 were also involved in the delivery of BazaLoader and Trickbot payloads — activity that overlaps with a group Microsoft tracks as DEV-0193.
Windows Office Product Spawned Uncommon Process ... CVE-2023-21716 Word RTF Heap Corruption, CVE-2023-36884 Office and Windows HTML RCE Vulnerability ...
27 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
アメリカ合衆国とイギリスが共同で Trickbot と呼ばれるマルウェアを操るサイバー犯罪グループ(別名: Wizard Spider )に所属する 7 名に対し制裁措置をとりました。 Trickbot は Ryuk や Conti など複数のランサムウェアの展開に使用されていたことが分かっています。
Qbot and TrickBot, in particular, were Emotet’s main customers and used their access to deploy ransomware (e.g. Ryuk, Conti, ProLock, Egregor, DoppelPaymer, and others).
"1359593325": "TrickBot/SmokeLoader/Nobelium/APT29 - Stats uniques -> ips/hostnames: 256 publickeys: 183"
However, also in 2017, it was observed delivering the Trojan.Trickybot and Ransom.UmbreCrypt ransomware.
TrickBot was developed in 2016 as a banking malware. However, since then it has developed into something essentially different — a flexible, universal, module-based crimeware solution.
Trickbot was first spotted in 2016 as a banking trojan that was created as a successor to Dyre and designed to steal banking credentials. Over the years, Trickbot’s operators were able to build a massive botnet, and the malware evolved into a modular malware available for malware-as-a-service.
36 distinct techniques documented for this family, organized by ATT&CK tactic.
RDPやVPNの不備...TrickBot/QakBotなどのマルウェアによってRDP等の認証情報を取得された可能性がある事例なども一般には報告されており...
In an attack scenario, threat actors could craft a malicious attachment and deliver it to victims via either email or a link inside of an email; the attachment would appear as a legitimate application.
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
The content repeatedly describes threat actors and malware using PowerShell to execute payloads, run commands, download additional malware, perform lateral movement, evade defenses, and execute scripts in memory. | Examples include: 'APT28 downloads and executes PowerShell scripts and performs PowerShell commands'; 'APT3 has used PowerShell on victim systems to download and run payloads after exploitation'; 'TA505 has used PowerShell to download and execute malware and reconnaissance scripts.'
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
RDPやVPNの不備...TrickBot/QakBotなどのマルウェアによってRDP等の認証情報を取得された可能性がある事例なども一般には報告されており...
The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.
RDPやVPNの不備...TrickBot/QakBotなどのマルウェアによってRDP等の認証情報を取得された可能性がある事例なども一般には報告されており...
The TrickBot Trojan has received an update that adds a UAC bypass targeting the Windows 10 operating system so that it infects users without displaying any visible prompts. | If it is Windows 7, TrickBot will utilize the CMSTPLUA UAC bypass and if Windows 10, will now use the Fodhelper UAC Bypass.
crypters, which are also referred to as loaders or packers, are applications designed to encrypt and obfuscate malware to evade detection by antivirus (AV) scanners and hinder analysis.
Exploitation allows a threat actor to create a malicious file that appears to be a legitimate application.
RDPやVPNの不備...TrickBot/QakBotなどのマルウェアによってRDP等の認証情報を取得された可能性がある事例なども一般には報告されており...
APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.
Another common evasion category involves detecting that a file is executing in a virtual machine (VM). This can involve fingerprinting resources like low CPU core count, system or video memory, or screen resolution. | The following are just a few examples of what malware authors can check for: Registry key paths showing VM-specific hardware, drivers or services. Filesystem paths for VM-specific drivers or other services. MAC addresses specific to some VM infrastructures.
TrickBot uses mimikatz to harvest emails and other credentials. | screenLocker_x64.dll: a module for reconnaissance and credential harvesting. It uses a component of mimikatz to extract credentials from the target system.
The new module contains a revamped version of its old banking component that tries to intercept credentials for e-banking websites. | Called a "webinject" module, this component has been rewritten to include new methods to inject malicious code inside banking websites.
Its payload is also minified and obfuscated... and contains the code which grabs the victim’s keystrokes and web form submit actions. | The injectDll module performs browser data injection, including JavaScript... The “second” stage of the web-inject... collects information from the login action and saves the “ap_email” and “ap_password” fields for a C2 payload.
tdpwgrab32 This module is a password stealer module. It can steal credentials stored in registry, databases of different applications, configuration and “precious files” | outlookDll32 ... tries to retrieve credentials from the Outlook profile stored in the system registry.
Agent Tesla can gather credentials from a number of browsers... APT3 has used tools to dump passwords from browsers... APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge
AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.
"psfin32" is a point-of-sale finder reconnaissance module hunts for point of sale related services, software, and machines in Lightweight Directory Access Protocol (LDAP) | networkDll ... to lightweight directory access protocol (LDAP) queries. | Active Directory Enumeration Methodologies ... allows TrickBot operators to collect domain controller information once they are already on the compromised machine.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."
Another common evasion category involves detecting that a file is executing in a virtual machine (VM). This can involve fingerprinting resources like low CPU core count, system or video memory, or screen resolution. | The following are just a few examples of what malware authors can check for: Registry key paths showing VM-specific hardware, drivers or services. Filesystem paths for VM-specific drivers or other services. MAC addresses specific to some VM infrastructures.
Patchwork dumped the login data database from \AppData\Local\Google\Chrome\User Data\Default\Login Data ... BeaverTail has also been known to collect login data from Firefox within key3.db, key4.db and logins.json from /.mozilla/firefox/ for exfiltration.
The new module contains a revamped version of its old banking component that tries to intercept credentials for e-banking websites. | Called a "webinject" module, this component has been rewritten to include new methods to inject malicious code inside banking websites.
Its payload is also minified and obfuscated... and contains the code which grabs the victim’s keystrokes and web form submit actions. | The injectDll module performs browser data injection, including JavaScript... The “second” stage of the web-inject... collects information from the login action and saves the “ap_email” and “ap_password” fields for a C2 payload.
APT41 used the Steam community page as a fallback mechanism for C2. Bazar has the ability to use an alternative C2 server if the primary server fails. BISCUIT malware contains a secondary fallback command and control server that is contacted after the primary command and control server.
all command and control (C&C) servers tied to the most recent campaigns reside within web hosting provider networks and were communicating with their infected hosts over port 443. | All of them used port 443 / HTTPS as a connection method from the infected machine back to the C&C host, a method commonly used by malware authors to evade detection from network security devices that don’t inspect encrypted traffic.
The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.
This campaign used many advanced persistence, lateral movement, and detection evasion measures, including attempts to disable Windows Defender, the use of EternalBlue to spread, and the stopping of multiple services and processes related to anti malware products.
1,481 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Originally a banking trojan, TrickBot evolved into modular information-stealing malware and a botnet used to provide remote access, steal credentials and financial/personal data, download additional modules, and enable follow-on ransomware deployment and lateral movement in victim networks.
Banking trojan with command-and-control functionality that can download and execute additional malware packages. The article describes it being installed via Godzilla Loader and using a download-and-execute command to retrieve further payloads.
A botnet/malware family referenced as an example of private-sector and government disruption operations; it had infected over one million computers and its servers were disrupted ahead of the 2020 election.
A malware family referenced here only as an affiliation of the crypting actor Bentley.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.