Weekly TrickBot Analysis - End of w/c 11-Dec-2017 to 1000105

[MalBot]

Here are the results of my analysis of TrickBot Banking Trojan mcconfs shared up to the end of the week commencing 11th December 2017. This analysis covers 1,047 unique C2 IP addresses used in 224 mcconfs across 95 versions, with a latest version of 1000105.

The following graph shows the rate of discovery of TrickBot versions in the wild, based on shared mcconfs. (Note: The flatter the line, the more frequently versions are discovered.)

Four new versions were discovered in the last week (1000102, 1000103, 1000104, and 1000105), five the week before, and five the week before that.

The following graph shows the number of server entries using ports:

• 443 (HTTPS);
• 445 (IBM AS Server Mapper) – INACTIVE;
• 449 (Cray Network Semaphore Server); and 
• 451 (SMB) – INACTIVE.

There was a dramatic increase in the number of C2 server entries in version 1000105, taking the count to 36 (within one of the high from versions 1000071 and 1000072).

The following table shows the top 25 servers (of  1,051 unique) used within the 95 versions. There was only one change from the previous week, with 79[.]106.41.9:449 moving up due to its use in version 1000102.

The following table shows the breakdown of detected TrickBot campaign ‘gtag’ (group tags) values used in the 224 mcconfs analysed. ‘mac1’ was detected in recent configs, alongside the test group tag.

60 C2 servers were used in last week’s mcconfs, of which 15 had been used previously, with only one – 79[.]106.41.9:449 – used before version 1000099. The BGP prefix registrations for the C2 server IP addresses continue to be heavily biased to RU. Last week’s server IP addresses are allocated to 45xRU, 4xUS, 2xGB, 2xNL, 2xPY, 1xAL, 1xCL, 1xLU, 1xPA, 1xPL.

New analysis shows the geographical location of 49 (those scanned by Shodan) of the 60 IP addresses used in last week’s configs. Four of the 49 are MikroTik devices, one is an ER-X. Of the remainder, 33 are running OpenSSH, 12 are running nginx, seven are running Apache, six are running Exim, two are running Postfix, one is running MySQL, and one is running ProFTP – with some servers running as many as four of these products.

The following table shows the BGP allocations of C2 servers’ IP addresses to country by TrickBot version.

Finally, the following table shows the top 25 BGP prefixes used by TrickBot for C2 servers. There has been a lot of movement in the prefixes on this list, but all but one prefix was already in the top 25 last week.

Thanks to @mpvillafranca94, @JR0driguezB, @0bscureC0de, @VK_Intel, @K_N1kolenko, @hasherezade, @botNET___, @ArnaudDlms, @StackGazer, @voidm4p, @James_inthe_box, @MakFLwana, @_ddoxer, @spalomaresg, @virsoz, @moutonplacide, @JasonMilletary, @Ring0x0, @precisionsec, @Techhelplistcom, @pollo290987, @MalHunters and @coldshellfor sharing the mcconfs.

Article Link: http://escinsecurity.blogspot.com/2017/12/weekly-trickbot-analysis-end-of-wc-11.html