ThaiCERT    ETDA    MDES
Report
Search
Home > List all groups > List all tools > List all groups using tool TrickBot

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: TrickBot

NamesTrickBot
Trickster
The Trick
Totbrick
TrickLoader
TSPY_TRICKLOAD
CategoryMalware
TypeBanking trojan, Backdoor, Info stealer, Credential stealer, Worm
Description(Trend Micro) Developed in 2016, TrickBot is one of the more recent banking Trojans, with many of its original features inspired by Dyreza (another banking Trojan). Besides targeting a wide array of international banks via its webinjects, Trickbot can also steal from Bitcoin wallets.

Some of its other capabilities include harvesting emails and credentials using the Mimikatz tool. Its authors also show an ability for constant new features and developments.

Trojan.TrickBot comes in modules accompanied by a configuration file. Each module has a specific task like gaining persistence, propagation, stealing credentials, encryption, and so on. The C&Cs are set up on hacked wireless routers.
Information<https://blog.malwarebytes.com/detections/trojan-trickbot/>
<https://www.cybereason.com/blog/triple-threat-emotet-deploys-trickbot-to-steal-data-spread-ryuk-ransomware>
<https://blog.malwarebytes.com/threat-analysis/2017/08/trickbot-comes-with-new-tricks-attacking-outlook-and-browsing-data/>
<http://www.vkremez.com/2017/11/lets-learn-trickbot-socks5-backconnect.html>
<https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-adds-remote-application-credential-grabbing-capabilities-to-its-repertoire/>
<http://www.vkremez.com/2017/12/lets-learn-introducing-new-trickbot.html>
<https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-shows-off-new-trick-password-grabber-module>
<https://www.fidelissecurity.com/threatgeek/2016/10/trickbot-we-missed-you-dyre>
<https://www.flashpoint-intel.com/blog/trickbot-account-checking-hybrid-attack-model/>
<http://www.peppermalware.com/2019/03/quick-analysis-of-trickbot-sample-with.html>
<https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/>
<https://www.crowdstrike.com/blog/sin-ful-spiders-wizard-spider-and-lunar-spider-sharing-the-same-web/>
<https://www.arbornetworks.com/blog/asert/trickbot-banker-insights/>
<https://blog.malwarebytes.com/threat-analysis/malware-threat-analysis/2018/11/whats-new-trickbot-deobfuscating-elements/>
<https://www.trustwave.com/Resources/SpiderLabs-Blog/Tale-of-the-Two-Payloads-%E2%80%93-TrickBot-and-Nitol/>
<http://www.vkremez.com/2018/04/lets-learn-trickbot-implements-network.html>
<https://securityintelligence.com/trickbot-takes-to-latin-america-continues-to-expand-its-global-reach/>
<https://qmemcpy.io/post/reverse-engineering-malware-trickbot-part-2-loader>
<https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html>
<https://securityintelligence.com/trickbots-cryptocurrency-hunger-tricking-the-bitcoin-out-of-wallets/>
<https://blog.fraudwatchinternational.com/malware/trickbot-malware-works>
<https://www.blueliv.com/research/trickbot-banking-trojan-using-eflags-as-an-anti-hook-technique/>
<https://f5.com/labs/articles/threat-intelligence/malware/trickbot-expands-global-targets-beyond-banks-and-payment-processors-to-crms>
<https://f5.com/labs/articles/threat-intelligence/malware/little-trickbot-growing-up-new-campaign-24412>
<https://github.com/JR0driguezB/malware_configs/tree/master/TrickBot>
<https://escinsecurity.blogspot.de/2018/01/weekly-trickbot-analysis-end-of-wc-22.html>
<https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/>
<https://www.fortinet.com/blog/threat-research/deep-analysis-of-trickbot-new-module-pwgrab.html>
<https://www.securityartwork.es/wp-content/uploads/2017/06/Informe_Evoluci%C3%B3n_Trickbot.pdf>
<https://blogs.forcepoint.com/security-labs/trickbot-spread-necurs-botnet-adds-nordic-countries-its-targets>
<http://blog.fortinet.com/2016/12/06/deep-analysis-of-the-online-banking-botnet-trickbot>
<https://www.cyberbit.com/blog/endpoint-security/latest-trickbot-variant-has-new-tricks-up-its-sleeve/>
<http://www.malware-traffic-analysis.net/2018/02/01/>
<https://www.cert.pl/en/news/single/detricking-trickbot-loader/>
<https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/evolving-trickbot-adds-detection-evasion-and-screen-locking-features>
<https://securityintelligence.com/tricks-of-the-trade-a-deeper-look-into-trickbots-machinations/>
<http://www.pwc.co.uk/issues/cyber-security-data-privacy/research/trickbots-bag-of-tricks.html>
<https://qmemcpy.io/post/reverse-engineering-malware-trickbot-part-3-core>
<https://www.ringzerolabs.com/2017/07/trickbot-banking-trojan-doc00039217doc.html>
<https://sysopfb.github.io/malware/2018/04/16/trickbot-uacme.html>
<https://blog.talosintelligence.com/2018/07/smoking-guns-smoke-loader-learned-new.html>
<https://www.vkremez.com/2018/11/lets-learn-introducing-latest-trickbot.html>
<https://qmemcpy.github.io/post/reverse-engineering-malware-trickbot-part-1-packer>
<https://www.botconf.eu/wp-content/uploads/2016/11/2016-LT09-TrickBot-Adams.pdf>
<https://www.flashpoint-intel.com/blog/new-version-trickbot-adds-worm-propagation-module/>
<https://blog.talosintelligence.com/2020/03/trickbot-primer.html>
<https://cybersecurity.att.com/blogs/labs-research/trickbot-bazarloader-in-depth#When:12:00:00Z>
<https://unit42.paloaltonetworks.com/goodbye-mworm-hello-nworm-trickbot-updates-propagation-module/>
<https://www.bleepingcomputer.com/news/security/fake-black-lives-matter-voting-campaign-spreads-trickbot-malware/>
<https://labs.sentinelone.com/inside-a-trickbot-cobaltstrike-attack-server/>
<https://www.bleepingcomputer.com/news/security/trickbot-malware-now-checks-screen-resolution-to-evade-analysis/>
<https://www.bleepingcomputer.com/news/security/trickbot-malware-mistakenly-warns-victims-that-they-are-infected/>
<https://www.cybereason.com/blog/vb2020-anchor-bazar-and-the-trickbot-connection>
<https://krebsonsecurity.com/2020/10/attacks-aimed-at-disrupting-the-trickbot-botnet/>
<https://www.washingtonpost.com/national-security/cyber-command-trickbot-disrupt/2020/10/09/19587aae-0a32-11eb-a166-dc429b380d10_story.html>
<https://blogs.microsoft.com/on-the-issues/2020/10/12/trickbot-ransomware-cyberthreat-us-elections/>
<https://www.zdnet.com/article/trickbot-botnet-survives-takedown-attempt-but-microsoft-sets-new-legal-precedent/>
<https://www.darkreading.com/vulnerabilities---threats/trickbot-phishing-ransomware-and-elections/a/d-id/1339190>
<https://blogs.microsoft.com/on-the-issues/2020/10/20/trickbot-ransomware-disruption-update/>
<https://www.netscout.com/blog/asert/dropping-anchor>
<https://www.intezer.com/blog/threat-hunting/trickbot-or-treat-2-0/>
<https://www.area1security.com/blog/trickbot-spear-phishing-drops-bazar-buer-malware-2/>
<https://www.darkreading.com/threat-intelligence/like-the-energizer-bunny-trickbot-goes-on-and-on-/d/d-id/1339432>
<https://www.bleepingcomputer.com/news/security/trickbot-turns-100-latest-malware-released-with-new-features/>
<https://labs.bitdefender.com/2020/11/trickbot-is-dead-long-live-trickbot/>
<https://www.bleepingcomputer.com/news/security/trickbot-malware-uses-obfuscated-windows-batch-script-to-evade-detection/>
<https://www.cyberscoop.com/trickbot-status-microsoft-cyber-command-takedown/>
<https://eclypsium.com/2020/12/03/trickbot-now-offers-trickboot-persist-brick-profit/>
<https://www.advanced-intel.com/post/persist-brick-profit-trickbot-offers-new-trickboot-uefi-focused-functionality>
<https://securityintelligence.com/posts/trickbot-survival-instinct-trickboot-version/>
<https://www.menlosecurity.com/blog/trickbot-new-year-old-lure>
<https://www.kryptoslogic.com/blog/2021/02/trickbot-masrv-module/>
<https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-006.pdf>
<https://www.bleepingcomputer.com/news/security/supermicro-pulse-secure-release-fixes-for-trickboot-attacks/>
<https://us-cert.gov/ncas/alerts/aa21-076a>
<https://us-cert.gov/sites/default/files/publications/TrickBot_Fact_Sheet_508.pdf>
<https://blog.sonicwall.com/en-us/2021/04/emotet-and-trickbot-the-battle-of-the-botnets/>
<https://www.riskiq.com/blog/external-threat-management/trickbot/>
<http://www.intel471.com/blog/cobalt-strike-cybercriminals-trickbot-qbot-hancitor>
<https://www.bitdefender.com/blog/labs/trickbot-activity-increases-new-vnc-module-on-the-radar>
<https://cofense.com/blog/trickbot-june-debut/>
MITRE ATT&CK<https://attack.mitre.org/software/S0266/>
Malpedia<https://malpedia.caad.fkie.fraunhofer.de/details/win.trickbot>
AlienVault OTX<https://otx.alienvault.com/browse/pulses?q=tag:TrickBot>

Last change to this tool card: 08 August 2021

Download this tool card in JSON format

Previous: TreasureHunter
Next: TrickMo

All groups using tool TrickBot

ChangedNameCountryObserved

APT groups

 Wizard Spider, Gold BlackburnRussia2014-Aug 2021 HOTX

1 group listed (1 APT, 0 other, 0 unknown)

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key