Weekly TrickBot Analysis - End of w/c 29-Jan-2018 to 1000123

[MalBot]

Here are the results of my analysis of TrickBot Banking Trojan mcconfs shared up to the end of the week commencing 29th January 2018. This analysis covers 1,379 unique C2 IP addresses used in 264 mcconfs across 125 versions, with a highest version of 1000123.

The following graph shows the rate of discovery of TrickBot versions in the wild, based on shared mcconfs. (Note: The flatter the line, the more frequently versions are discovered.)

Seven versions were discovered in the week commencing 22th January 2018 (A-1000120, A-1000121, A-1000122, A-1000123, B-1000030, B-1000031, and B-1000032), seven the week before, and two the week before that. Four of the discovered versions extend the original iteration of version numbers (which I refer to as iteration A), taking this to 1000123. Three shared versions extend the nine repeats from the last few months, where low (1000021 to 1000029) version numbers are reused. (I track these as part of a new, distinct iteration, iteration B, of the version numbers.)

The following graph shows the number of server entries using ports:

• 443 (HTTPS);
• 445 (IBM AS Server Mapper) – INACTIVE;
• 449 (Cray Network Semaphore Server); and 
• 451 (SMB) – INACTIVE.

This week’s iteration A configs continue the recent fluctuations, but increased the number of port 449 servers slightly. The iteration B configs seen doubled the low C2 server count which had previously typified iteration B.

The following table shows the top 25 servers (of  1,379 unique) used within the 125 versions. This table stays the same as the week before due to the significant amount of new C2 server addresses.

The following table shows the breakdown of detected TrickBot campaign ‘gtag’ (group tags) values used in the 264 mcconfs analysed. 

99 C2 servers were used in the mcconfs from this week, of which 77 (78%) were new. The BGP prefix registrations for the C2 server IP addresses continue to be heavily biased to ASN routed through RU (and so the graph below’s Y-axis is cut short to allow clearer viewing of other country counts). The new servers’ IP addresses are associated with ASN routed to: 71xRU, 4xNL, 1xLU, and 1xUS.

The following map shows the geographical location of 84 (those with location data) of 86 (scanned by Shodan) of the 99 IP addresses used in the analysed configs.

Two of these servers are MikroTik devices (historically a favourite of TrickBot), and one is an ERLite-3.

60 are running OpenSSH, 34 are running nginx, 16 are running Apache, 10 are running Exim, five are running Postfix, five are running MySQL, three are running ProFTPD, one is running DarkRP, and one is running Dropbear SSH – with some servers running as many as five of these products.

The following table shows the BGP allocations of C2 servers’ IP addresses to country by TrickBot version.

Finally, the following table shows the top 25 BGP prefixes used by TrickBot for C2 servers.

Thanks to @mpvillafranca94, @JR0driguezB, @0bscureC0de, @virsoz, @spalomaresg, @VK_Intel, @K_N1kolenko, @hasherezade, @botNET___, @ArnaudDlms, @StackGazer,@voidm4p, @James_inthe_box, @MakFLwana, @_ddoxer, @moutonplacide, @JasonMilletary,@Ring0x0, @precisionsec, @Techhelplistcom, @pollo290987, @MalHunters, @coldshell, @0x7fff9 and @MalwareSecrets for sharing the mcconfs.

Article Link: http://escinsecurity.blogspot.com/2018/02/weekly-trickbot-analysis-end-of-wc-29.html