Weekly TrickBot Analysis - End of w/c 24-Sep-2018 to A-1000270, B-1000068, and C-1000198

Here are the results of my analysis of TrickBot Banking Trojan mcconfs shared up to the end of the week commencing 24th September 2018. This analysis covers 2,691 unique C2 IP addresses used in 588 mcconfs across 322 versions, with highest versions of A-1000270, B-1000068, and C-1000198.

Background:
Since its first use from approximately 19th October 2016, TrickBot has frequently issued new versions of its XML configuration file, mcconf. Originally there was a single chain of config versions which started at 1000002. (There may have been a 1000001 but it is not been shared publicly.) I refer to this original sequence as iteration A. On 16th November 2017 TrickBot mcconfs were issued for older version numbers than the current iteration A configs, but with different command and control (C2) servers to those in that version's iteration A config. This indicated the start of iteration B, a new sequence of configs believed to be for a second botnet. While there is a small amount of overlap of the C2 servers between iteration A and iteration B, the majority of C2 servers are specific to an iteration (hence botnet). The iteration B botnet stopped receiving new configs on 28th February 2018. As of 28th March 2018 another iteration, iteration C, was started, once again repeating previously used version numbers but with different C2 server lists. Victim hosts in that third botnet were merged into the iteration A botnet as of 23rd May 2018.

This week's analysis:
Figure 1 shows the rate of discovery of TrickBot versions in the wild, based on shared mcconfs. The flatter the line, the more frequently versions are discovered. Ignore the two long, almost vertical lines which coincide with the switch from one iteration to the next. These vertical lines are purely an artefact of graphing the data in a single series. (Note: Full size versions of all the graphs and tables are available via the link at the end of this post.)

There were five new config versions discovered in the week commencing 24th September 2018, (A-1000266, A-1000267, A-1000268, A-1000269, and A-1000270), four the week before, and four the week before that. All new config versions extend the iteration A botnet, taking this to 1000270. The secondary, iteration B, botnet was not extended in the discovered versions and remains unchanged since 1000068 of 28th February 2018. The tertiary, iteration C, botnet was merged into the iteration A botnet on 23rd May 2018.

Figure 1 - TrickBot Version Discovery Dates

The following graphs (Figures 2 and 3) show the number of server entries using ports:

• 443 (HTTPS);
• 444 (Simple Network Paging Protocol) -- INACTIVE;
• 445 (IBM AS Server Mapper) -- INACTIVE;
• 449 (Cray Network Semaphore Server); and 
• 451 (SMB) -- INACTIVE.

Figure 2 is for iteration A configs, Figure 3 is for previous iteration B and C configs. Between mid April 2018 and early September 2018, the length of the C2 server lists stabilised significantly in iteration A configs, with between 25 and 33 server entries. As of September 10th there was a jump to lists of 39 C2 servers.

Between April 2018 and late June 2018, the percentage of :443 (HTTPS) servers in the C2 lists increased (albeit with intermittent, temporary drops) from 1/3rd to almost all of the list. During June and July 2018, the proportion saw little fluctuation, but it fell to approximately 2/3rds during August 2018. In early September the proportion of :443 (HTTPS) servers dropped to approximately 50% as new servers within longer lists used :449 (Cray Network Semaphore Server).

Figure 2 - TrickBot SRV Port Usage (Iteration A)

Figure 3 - TrickBot SRV Port Usage (Iterations B and C)

Figure 4 shows the top 25 servers (of  2,714 unique) used within the 322 versions. While 68[.]109[.]83[.]22[:]443 continued being used this week and moved up to fourth, use of 70[.]79[.]178[.]120[:]449 stopped after it rose to second place. Server 47[.]49[.]168[.]50[:]443 continued to be used, and moved from 14th to eighth. Additionally, two new servers, 46[.]149[.]182[.]112[:]449 and 81[.]17[.]86[.]112[:]443, entered the top 25 at 20th and 23rd, respectively.

Figure 4 - TrickBot Top 25 SRV

Figure 5 shows the number of mcconfs per campaign identifier for identifiers seen more than once. 

Figure 5 - TrickBot Campaign mcconf Counts (where seen more than once)

59 unique C2 servers were used in the mcconfs from this week, of which 25 (42%) were new. Figure 6 shows the proportional server count of mcconfs shared each week (when compared to the greatest count in a week), along with the percentage churn of the servers. The linear churn trend line (dotted) highlights that the churn percentage has been reducing since December 2017, with an increasing proportion of servers being re-used from one week to the next. However, the 8 week rolling average (dashed) shows that this long-term trend mostly levelled off through the summer, with a slight decrease still present.

Figure 6 - TrickBot Weekly Advertised SRV Count and Churn

The BGP prefix registrations for the C2 server IP addresses continue to be heavily biased to ASN routed through RU (and so Figure 7's Y-axis is cut short to allow clearer viewing of other country counts). The new servers' IP addresses are associated with ASN routed to: 5xUS, 4xCA, 2xVN, 2xZA, 1xAT, 1xBR, 1xCR, 1xEC, 1xFR, 1xKE, 1xIR, 1xMX, 1xMU, 1xPL, 1xRU, and 1xTT. In recent months the proportion of servers with IP addresses routed through RU has reduced. The diversity of countries has also increased slightly.

Figure 7 - TrickBot SRV IP Address BGP Prefix Country Codes

Figure 8 shows the geographical location of 53 (those with location data) of 53 (scanned by Shodan) of the 59 C2 server IP addresses used in the analysed configs.

According to Shodan's most recent data:

• 36 are MikroTik devices and five are Ubiquiti devices.
• 18 are running nginx, 13 are running OpenSSH, four are running Dropbear SSH, three are running Postfix, and two are running Apache.

Figure 8 - TrickBot C2 Server IP Locations For New Configs

Figure 9 shows the top 25 BGP prefixes used by TrickBot for C2 servers.

Figure 9 - TrickBot Top 25 BGP Prefixes

Full size versions of the figures included in this post are available here. I also have a page documenting the various discrepancies identified in TrickBot's mcconf files.

Thanks to hasherezade, mpvillafranca94, JR0driguezB, 0bscureC0de, VK_Intel, K_N1kolenko, botNET___, ArnaudDlms, StackGazer, voidm4p, James_inthe_box, MakFLwana, _ddoxer, spalomaresg, virsoz, moutonplacide, JasonMilletary, Ring0x0, precisionsec, Techhelplistcom, pollo290987, MalHunters, coldshell, 0x7fff9, kobebryamV2, dvk01uk, benkow_, MalwareSecrets, SaurabhSha15, abuse_ch, HerbieZimmerman, Artilllerie, and mesa_matt.

This post was made by @EscInSecurity and first appeared on https://escinsecurity.blogspot.com/.

Weekly TrickBot Analysis - End of w/c 17-Sep-2018 to A-1000265, B-1000068, and C-1000198

Here are the results of my analysis of TrickBot Banking Trojan mcconfs shared up to the end of the week commencing 17th September 2018. This analysis covers 2,667 unique C2 IP addresses used in 582 mcconfs across 317 versions, with highest versions of A-1000265, B-1000068, and C-1000198.

Background:
Since its first use from approximately 19th October 2016, TrickBot has frequently issued new versions of its XML configuration file, mcconf. Originally there was a single chain of config versions which started at 1000002. (There may have been a 1000001 but it is not been shared publicly.) I refer to this original sequence as iteration A. On 16th November 2017 TrickBot mcconfs were issued for older version numbers than the current iteration A configs, but with different command and control (C2) servers to those in that version's iteration A config. This indicated the start of iteration B, a new sequence of configs believed to be for a second botnet. While there is a small amount of overlap of the C2 servers between iteration A and iteration B, the majority of C2 servers are specific to an iteration (hence botnet). The iteration B botnet stopped receiving new configs on 28th February 2018. As of 28th March 2018 another iteration, iteration C, was started, once again repeating previously used version numbers but with different C2 server lists. Victim hosts in that third botnet were merged into the iteration A botnet as of 23rd May 2018.

This week's analysis:
Figure 1 shows the rate of discovery of TrickBot versions in the wild, based on shared mcconfs. The flatter the line, the more frequently versions are discovered. Ignore the two long, almost vertical lines which coincide with the switch from one iteration to the next. These vertical lines are purely an artefact of graphing the data in a single series. (Note: Full size versions of all the graphs and tables are available via the link at the end of this post.)

There were four new config versions discovered in the week commencing 17th September 2018, (A-1000262, A-1000263, A-1000264, and A-1000265), four the week before, and four the week before that. All new config versions extend the iteration A botnet, taking this to 1000265. The secondary, iteration B, botnet was not extended in the discovered versions and remains unchanged since 1000068 of 28th February 2018. The tertiary, iteration C, botnet was merged into the iteration A botnet on 23rd May 2018.

Figure 1 - TrickBot Version Discovery Dates

The following graphs (Figures 2 and 3) show the number of server entries using ports:

• 443 (HTTPS);
• 444 (Simple Network Paging Protocol) -- INACTIVE;
• 445 (IBM AS Server Mapper) -- INACTIVE;
• 449 (Cray Network Semaphore Server); and 
• 451 (SMB) -- INACTIVE.

Figure 2 is for iteration A configs, Figure 3 is for previous iteration B and C configs. Between mid April 2018 and early September 2018, the length of the C2 server lists stabilised significantly in iteration A configs, with between 25 and 33 server entries. As of September 10th there was a jump to lists of 39 C2 servers.

Between April 2018 and late June 2018, the percentage of :443 (HTTPS) servers in the C2 lists increased (albeit with intermittent, temporary drops) from 1/3rd to almost all of the list. During June and July 2018, the proportion saw little fluctuation, but it fell to approximately 2/3rds during August 2018. In early September the proportion of :443 (HTTPS) servers dropped to approximately 50% as new servers added used :449 (Cray Network Semaphore Server).

Figure 2 - TrickBot SRV Port Usage (Iteration A)

Figure 3 - TrickBot SRV Port Usage (Iterations B and C)

Figure 4 shows the top 25 servers (of  2,689 unique) used within the 317 versions. 70[.]79[.]178[.]120[:]449 and 68[.]109[.]83[.]22[:]443 continued being used this week, moving up to third and sixth respectively. Two recent servers added last week, 47[.]49[.]168[.]50[:]443 and 96[.]43[.]40[.]221[:]443, increased up the table, but the later was dropped from the most recent config this week.

Figure 4 - TrickBot Top 25 SRV

Figure 5 shows the number of mcconfs per campaign identifier for identifiers seen more than once. 

Figure 5 - TrickBot Campaign mcconf Counts (where seen more than once)

46 unique C2 servers were used in the mcconfs from this week, of which 12 (26%) were new. Figure 6 shows the proportional server count of mcconfs shared each week (when compared to the greatest count in a week), along with the percentage churn of the servers. The linear churn trend line (dotted) highlights that the churn percentage has been reducing since December 2017, with an increasing number of servers being re-used from one week to the next. However, the 8 week rolling average (dashed) shows that this long-term trend mostly levelled off through the summer, with a slight decrease still present.

Figure 6 - TrickBot Weekly Advertised SRV Count and Churn

The BGP prefix registrations for the C2 server IP addresses continue to be heavily biased to ASN routed through RU (and so Figure 7's Y-axis is cut short to allow clearer viewing of other country counts). The new servers' IP addresses are associated with ASN routed to: 3xUS, 2xID, 1xBG, 1xBR, 1xCO, 1xHU,1xKH, 1xPL, and 1xSG.

Figure 7 - TrickBot SRV IP Address BGP Prefix Country Codes

Figure 8 shows the geographical location of 45 (those with location data) of 45 (scanned by Shodan) of the 46 C2 server IP addresses used in the analysed configs.

According to Shodan's most recent data:

• 22 are MikroTik devices and seven are Ubiquiti devices.
• 13 are running nginx, 12 are running OpenSSH, six are running Dropbear SSH, two are running Apache, and two are running Postfix.

Figure 8 - TrickBot C2 Server IP Locations For New Configs

Figure 9 shows the top 25 BGP prefixes used by TrickBot for C2 servers.

Figure 9 - TrickBot Top 25 BGP Prefixes

Full size versions of the figures included in this post are available here. I also have a page documenting the various discrepancies identified in TrickBot's mcconf files.

Thanks to hasherezade, mpvillafranca94, JR0driguezB, 0bscureC0de, VK_Intel, K_N1kolenko, botNET___, ArnaudDlms, StackGazer, voidm4p, James_inthe_box, MakFLwana, _ddoxer, spalomaresg, virsoz, moutonplacide, JasonMilletary, Ring0x0, precisionsec, Techhelplistcom, pollo290987, MalHunters, coldshell, 0x7fff9, kobebryamV2, dvk01uk, benkow_, MalwareSecrets, SaurabhSha15, abuse_ch, HerbieZimmerman, Artilllerie, and mesa_matt.

This post was made by @EscInSecurity and first appeared on https://escinsecurity.blogspot.com/.

Weekly TrickBot Analysis - End of w/c 10-Sep-2018 to A-1000261, B-1000068, and C-1000198

Here are the results of my analysis of TrickBot Banking Trojan mcconfs shared up to the end of the week commencing 10th September 2018. This analysis covers 2,655 unique C2 IP addresses used in 573 mcconfs across 313 versions, with highest versions of A-1000261, B-1000068, and C-1000198.

Background:
Since its first use from approximately 19th October 2016, TrickBot has frequently issued new versions of its XML configuration file, mcconf. Originally there was a single chain of config versions which started at 1000002. (There may have been a 1000001 but it is not been shared publicly.) I refer to this original sequence as iteration A. On 16th November 2017 TrickBot mcconfs were issued for older version numbers than the current iteration A configs, but with different command and control (C2) servers to those in that version's iteration A config. This indicated the start of iteration B, a new sequence of configs believed to be for a second botnet. While there is a small amount of overlap of the C2 servers between iteration A and iteration B, the majority of C2 servers are specific to an iteration (hence botnet). The iteration B botnet stopped receiving new configs on 28th February 2018. As of 28th March 2018 another iteration, iteration C, was started, once again repeating previously used version numbers but with different C2 server lists. Victim hosts in that third botnet were merged into the iteration A botnet as of 23rd May 2018.

This week's analysis:
Figure 1 shows the rate of discovery of TrickBot versions in the wild, based on shared mcconfs. The flatter the line, the more frequently versions are discovered. Ignore the two long, almost vertical lines which coincide with the switch from one iteration to the next. These vertical lines are purely an artefact of graphing the data in a single series. (Note: Full size versions of all the graphs and tables are available via the link at the end of this post.)

There were four new config versions discovered in the week commencing 10th September 2018, (A-1000258, A-1000259, A-1000260, and A-1000261), four the week before, and three the week before that. All new config versions extend the iteration A botnet, taking this to 1000261. The secondary, iteration B, botnet was not extended in the discovered versions and remains unchanged since 1000068 of 28th February 2018. The tertiary, iteration C, botnet was merged into the iteration A botnet on 23rd May 2018.

Figure 1 - TrickBot Version Discovery Dates

The following graphs (Figures 2 and 3) show the number of server entries using ports:

• 443 (HTTPS);
• 444 (Simple Network Paging Protocol) -- INACTIVE;
• 445 (IBM AS Server Mapper) -- INACTIVE;
• 449 (Cray Network Semaphore Server); and 
• 451 (SMB) -- INACTIVE.

Figure 2 is for iteration A configs, Figure 3 is for previous iteration B and C configs. Since mid April 2018, the length of the C2 server lists has stabilised significantly in iteration A configs, with between 25 and 33 server entries. Between April 2018 and late June 2018, the percentage of :443 (HTTPS) servers in those lists increased (albeit with intermittent, temporary drops), from 1/3rd to almost all of the list. During June and July 2018, the number of server entries and the proportion of :443 (HTTPS) servers saw little fluctuation. During August 2018, the proportion of :443 (HTTPS) servers fell to approximately 2/3rds. In early September the length of the C2 server lists jumped to their longest ever and reduced the proportion of :443 (HTTPS) servers to approximately 50%.

Figure 2 - TrickBot SRV Port Usage (Iteration A)

Figure 3 - TrickBot SRV Port Usage (Iterations B and C)

Figure 4 shows the top 25 servers (of  2,677 unique) used within the 313 versions. 70[.]79[.]178[.]120[:]449 and 68[.]109[.]83[.]22[:]443 continued being used this week, moving up to fifth and seventh respectively. Two new servers, 47[.]49[.]168[.]50[:]443 and 96[.]43[.]40[.]221[:]443, entered the top 25 this week..

Figure 4 - TrickBot Top 25 SRV

Figure 5 shows the number of mcconfs per campaign identifier for identifiers seen more than once. 

Figure 5 - TrickBot Campaign mcconf Counts (where seen more than once)

48 unique C2 servers were used in the mcconfs from this week, of which 25 (52%) were new. Figure 6 shows the proportional server count of mcconfs shared each week (when compared to the greatest count in a week), along with the percentage churn of the servers. The linear churn trend line (dotted) highlights that the churn percentage has been reducing since December 2017, with an increasing number of servers being re-used from one week to the next. However, the 8 week rolling average (dashed) shows that this long-term trend recently levelled off.

The reduced churn percentage, regular number of unique C2 servers used per week, stabilised length of mcconf server list, and stable percentage of :443 servers through the last few months all demonstrate the increased maturity and stability of TrickBot infrastructure management.

Figure 6 - TrickBot Weekly Advertised SRV Count and Churn

The BGP prefix registrations for the C2 server IP addresses continue to be heavily biased to ASN routed through RU (and so Figure 7's Y-axis is cut short to allow clearer viewing of other country counts). The new servers' IP addresses are associated with ASN routed to: 10xUS, 4xUA, 3xRU, 2xAT, 2xID, 1xBW, 1xIT, 1xGB, and 1xKH.

Figure 7 - TrickBot SRV IP Address BGP Prefix Country Codes

Figure 8 shows the geographical location of 46 (those with location data) of 46 (scanned by Shodan) of the 48 C2 server IP addresses used in the analysed configs.

According to Shodan's most recent data:

• 19 are MikroTik devices and six are Ubiquiti devices.
• 16 are running OpenSSH, 11 are running nginx, seven are running Apache, five are running Dropbear SSH,  three are running Postfix, two are running Exim, one is running Pure FTP. and one is running a Conan Exiles server.

Figure 8 - TrickBot C2 Server IP Locations For New Configs

Figure 9 shows the top 25 BGP prefixes used by TrickBot for C2 servers.

Figure 9 - TrickBot Top 25 BGP Prefixes

Full size versions of the figures included in this post are available here. I also have a page documenting the various discrepancies identified in TrickBot's mcconf files.

Thanks to hasherezade, mpvillafranca94, JR0driguezB, 0bscureC0de, VK_Intel, K_N1kolenko, botNET___, ArnaudDlms, StackGazer, voidm4p, James_inthe_box, MakFLwana, _ddoxer, spalomaresg, virsoz, moutonplacide, JasonMilletary, Ring0x0, precisionsec, Techhelplistcom, pollo290987, MalHunters, coldshell, 0x7fff9, kobebryamV2, dvk01uk, benkow_, MalwareSecrets, SaurabhSha15, abuse_ch, HerbieZimmerman, Artilllerie, and mesa_matt.

This post was made by @EscInSecurity and first appeared on https://escinsecurity.blogspot.com/.