cancel
Showing results for 
Search instead for 
Did you mean: 
Shaul_Vilkomir-
Historic F5 Account

TrickBot does not rest. Following the recent addition of its first targeted US-based bank, a new version of the malware has been spotted in the wild.

Now in its 11th incarnation, TrickBot has expanded its ever growing target portfolio yet again – this time increasing its focus on Germany.

 

0151T000003d6x1QAA.png

Figure 1 – TrickBot configuration, showing its most recent version upgrade

 

While previously TrickBot’s focus in Germany was distinctly on Sparkassen Finanzgruppe, this latest version now includes more previously untargeted financial institutions in Germany.

 

0151T000003d6x2QAA.png 0151T000003d6x3QAA.png

0151T000003d6x4QAA.png 0151T000003d6x5QAA.png

0151T000003d6x6QAA.png 0151T000003d6x7QAA.png

Figures 2-7 – TrickBot Dynamic Webinject configuration snippets showing some of its recently added targets in Germany

 

TrickBot continues to evolve rapidly, constantly adding targets and using varying techniques to pose an ever increasing risk to online banking users and financial institutions in multiple regions across the globe.

 

Recent TrickBot malware sample MD5s: c044f4a710f3a0b1997a4470145677ea, 07df1af1c3b8c33df61ff4f3f07f3f54

 

VirusTotal links:

https://www.virustotal.com/en/file/f560268063ab5a2104482937212f75714a55da680d50efe4c20b1a80b29a6e8f/...

https://www.virustotal.com/en/file/05389e4a60b59cb6b4d4ebe959837441b4fbbb71dd17cac77778d8973b480a26/...

 

Analysis links:

https://www.hybrid-analysis.com/sample/05389e4a60b59cb6b4d4ebe959837441b4fbbb71dd17cac77778d8973b480...

https://www.hybrid-analysis.com/sample/f560268063ab5a2104482937212f75714a55da680d50efe4c20b1a80b29a6...

 

References:

TrickBot targets its first US bank - https://devcentral.f5.com/s/articles/malware/trickbot-targets-its-first-us-bank-24713

TrickBot targeting Sparkassen Finanzgruppe - https://f5.com/labs/articles/threat-intelligence/malware/trickbot-now-targeting-german-banking-group...

Review of TrickBots rapid evolution - https://devcentral.f5.com/s/articles/malware/is-xmaker-the-new-trickloader-24372

Version history
Last update:
‎26-Jan-2017 04:30
Updated by:
Contributors