S2 Grupo TrickBot June 2017

TrickBot collects local files and information from the victim’s local machine.

TrickBot collects a list of install programs and services on the system’s machine.

TrickBot obtains the IP address, location, and other relevant network information from the victim’s machine.

TrickBot uses non-descriptive names to hide functionality.

TrickBot leverages a custom packer to obfuscate its functionality.

TrickBot uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files.

TrickBot creates a scheduled task on the system that provides persistence.

TrickBot injects into the svchost.exe process.

TrickBot uses HTTPS to communicate with its C2 servers, to get malware updates, modules that perform most of the malware logic and various configuration files.

TrickBot gathers the OS version, machine name, CPU type, amount of RAM available, and UEFI/BIOS firmware information from the victim’s machine.

TrickBot searches the system for all of the following file extensions: .avi, .mov, .mkv, .mpeg, .mpeg4, .mp4, .mp3, .wav, .ogg, .jpeg, .jpg, .png, .bmp, .gif, .tiff, .ico, .xlsx, and .zip. It can also obtain browsing history, cookies, and plug-in information.

TrickBot collects the users of the system.

TrickBot uses the Windows API call, CreateProcessW(), to manage execution flow. TrickBot has also used Nt* API functions to perform Process Injection.

Some TrickBot samples have used HTTP over ports 447 and 8082 for C2. Newer versions of TrickBot have been known to use a custom communication protocol which sends the data unencrypted over port 443.