#TrickBot

Check out my latest (and first 😀) blogpost on how to convert trickbot fake C2 IPs to the _real_ IPs #trickbot @hasherezade @VK_Intel @hatching_io

2020-04-26:📚[🆕Advanced Course Preview] Learn Active Directory Harvesting Implementation #TrickBot Example👁‍🗨 1⃣AD Dumper & Registry Harvester:AdllDll 2⃣Network: networkDll 3⃣Domain: domainDll 4⃣Worm: wormDll 5⃣Point-of-Sale: psfinDll cc/ @0verfl0w_

I updated the #TrickBot decoder ( Now you can extract the config from the settings file

#Trickbot has compromised over a million devices around the world since 2016 and ESET has been tracking its activities since the beginning. When the opportunity to join an international #takedown of their operation presented itself, we did not hesitate.

2020-12-20:📺[Course] #Zero2Automated: Learn Automation & Malware Reversing Engineering: Capabilities of Rootkits & Bootkits - #TrickBoot Case Study 📚Overview of Boot Process, SPI Controller & UEFI Firmware only via | #TrickBot cc @0verflow | @sysopfb

Visual graph of doxed #TrickBot group members as published by #trickbotleaks High resolution: PS1: Maltego file in the repo. #ThreatIntelligence @JGomes_EU @SOSIntel @modernanalytica @sharimahmad07

Thoughts on #Trickbot takedown with a focus on US Cyber Command actions and authorities - and their implications:

Unpacking #TrickBot:

Let's Learn: Extracting #Trickbot Banker IOC | "serv710" HRMC campaign" | mailsearcher32 & etc | Credit: @dvk01uk 👍

Due to the recent UpT(r)ick of #Trickbot activity we share 2 @Suricata_IDS rules which detect observed Trickbot exfiltration and communication activity

#Trickbot 🤖 new Exec Flow #DFIR: Excel > CMD > mshta > PowerShell > CMD > Rundll32 > Rundll32 (unpack) > wermgr (injection) > svchost (injection) Stage 1 mshta hxxp://87.251.85[.]100/love/love7[.]html Stage2 PS hxxp://5.182.206[.]13/images/panther[.]png

⚠️ WATCH OUT! Notorious #TrickBot computer virus gets a new UEFI/BIOS bootkit functionality to hide and maintain firmware-level persistence on infected machines. Read details — #infosec #cybersecurity #malware #tech

9-4-2018: #TrickBot #Banker | Interesing Browser-Focused Keylogger Trick | SetWindowsEx Hooking for Browser Classes { 'IEFrame', 'MozillaWindowClass', 'Chrome_WidgetWin_1' } API: GetKeyboardLayout GetAsyncKeyState GetKeyboardState ToUnicodeEx MD5: 543bd4c9e766e79c56c3061032cedd7c

#TrickBot / #TrickLoader - does anyone recognize this stealer? (sample:

The infamous #Emotet botnet has returned with the help of the #TrickBot malware, nearly 10 months after a coordinated law enforcement operation dismantled its C&C infrastructure in late January 2021. Read details: #infosec #cybersecurity #hacking

2020-11-17:🆕🔥#TrickBot Banker #Malware | 🥳 100th built ➡️ "1101" cfg: 1⃣"Memory DLL loading code" (Github Copy/Paste) 2⃣Interesting Loader Process (Doppel)|Hollowing Injection via legitimate wermgr.exe w/ CreateProcessInternalW 🛡️Stay protected / 🔎 for wermgr process inj

2020-12-03:🔥 And ... [Major Discovery] 🤖"Persist, Brick, Profit -#TrickBot Offers New “#TrickBoot” UEFI-Focused Functionality" 🆕*First* Time Crimeware Group Pursued UEFI Firmware Exploitation | #YARA+IOCs in MISP JSON/CSV @eclypsium | @IntelAdvanced

Some updates for my #TrickBot scripts: - including a keygen for the BotKey //thanks @malware_traffic for the sample!

11-18-2017: Let's Learn: #Trickbot banking #Trojan Checks for various loaded DLL's via GetModuleHandle API after decryption TL; DR the #malware retrieves a handle for the specified modules associated with various anti-virus products and sandbox engines to prevent analysis 😉

Huge #TrickBot malspam campaign incoming (gtag ono82), using weaponized word documents 💣 Sample (doc): 👉