TrickBooster

The module is employed to harvest Email credentials and contacts from a victim’s address book, inbox, outbox, it can send out malicious spam Emails from the victim’s compromised account... We believe this module is used by Trickbot for several purposes; prorogation and infection, spreading spam for monetization purposes...

It can grab emails from Outlook and send spam through Outlook using MAPI. It also removes traces of spamming by deleting emails from the Outlook Sent Items folder.

We analyzed the malware sample and found swaths of PowerShell code in its memory. Analysis of this PowerShell code immediately led us to the conclusion that we are dealing with a mail-bot.

This clean-up is thorough and involves deleting the original infecting executable file, which is a very common practice employed by many malware families.

Recent findings from a currently active and ongoing TrickBot campaign, which features extensive use of signed malware binaries... TrickBooster, which is signed with a valid certificate.

it can send out malicious spam Emails from the victim’s compromised account, and finally delete the sent messages from both outbox and the trash folder, so as to remain hidden from the user.

The module is employed to harvest Email credentials and contacts from a victim’s address book, inbox, outbox... This file, whose main functionality appears to be an e-mail collector targeting OUTLOOK.exe... When OUTLOOK.exe is executed - this module knows to start interacting with it by using Microsoft Outlook Messaging API (MAPI).

Stage 1 – Victim machine, infected with TrickBot, receives instruction from TrickBot command and control to download TrickBooster... Stage 2 – TrickBooster reports back to dedicated command and control server, sending lists of harvested e-mail credentials and addresses. Stage 3 – TrickBooster command and control server instructs bot to send malicious spam e-mails.