Weekly TrickBot Analysis - End of w/c 12-Mar-2018 to A-1000147 and B-1000068

Here are the results of my analysis of TrickBot Banking Trojan mcconfs shared up to the end of the week commencing 12th March 2018. This analysis covers 1,815 unique C2 IP addresses used in 343 mcconfs across 185 versions, with highest versions of A-1000147 and B-1000068.

The following graph shows the rate of discovery of TrickBot versions in the wild, based on shared mcconfs. (Note: The flatter the line, the more frequently versions are discovered.)

Six new versions were discovered in the week commencing 12th March 2018 (A-1000142, A-1000143, A-1000144, A-1000145, A-1000146, and A-1000147), four the week before, and nine the week before that. All six of the discovered versions extend the original iteration of version numbers (which I refer to as iteration A), taking this to 1000147. The secondary botnet, which is reusing earlier version numbers, was not extended in the discovered versions and remains unchanged for two weeks. (I track these as part of a new, distinct iteration, iteration B, of the version numbers.)

The following graph shows the number of server entries using ports:

• 443 (HTTPS);
• 444 (Simple Network Paging Protocol) -- INACTIVE;
• 445 (IBM AS Server Mapper) -- INACTIVE;
• 449 (Cray Network Semaphore Server); and 
• 451 (SMB).

This week's iteration A configs' command and control (C2) server lists were mostly comparable to those of the last few weeks'; however, the number of :449 (Cray Network Semaphore Server) servers returned to two or three. Notably, two of the :449 servers were switched to :451 (SMB) servers on the same IP address in version 1000147. This change reintroduced port :451, which has been absent since version 1000111 from January 1st.

The following table shows the top 25 servers (of  1,815 unique) used within the 185 versions. 212[.]14[.]51[.]43 and 212[.]14[.]51[.]56 increased in the number of uses, but otherwise the table is unchanged from last week.

The following table shows the breakdown of detected TrickBot campaign 'gtag' (group tags) values used in the 343 mcconfs analysed. 

62 C2 servers were used in the mcconfs from this week, of which 56 (90%) were new. The BGP prefix registrations for the C2 server IP addresses continue to be heavily biased to ASN routed through RU (and so the graph below's Y-axis is cut short to allow clearer viewing of other country counts). The new servers' IP addresses are associated with ASN routed to: 29xRU, 7xUA, 5xGB, 4xFR, 3xNL, 3xUS, 2xPA, 2xPL, and 1xCH.

The following map shows the geographical location of 36 (those with location data) of 38 (scanned by Shodan) of the 62 C2 servers used in the analysed configs.

According to Shodan's most recent data:

• 16 are running OpenSSH, 9 are running nginx, four are running Dropbear SSH, one is running Apache, one is running MySQL,  and one is running Postfix.

The following table shows the BGP allocations of C2 servers' IP addresses to country by TrickBot version.

Finally, the following table shows the top 25 BGP prefixes used by TrickBot for C2 servers.

Full size versions of the images included in this post are available here.

Thanks to @mpvillafranca94, @JR0driguezB, @0bscureC0de, @virsoz, @spalomaresg, @VK_Intel, @K_N1kolenko, @hasherezade, @botNET___, @ArnaudDlms, @StackGazer,@voidm4p, @James_inthe_box, @MakFLwana, @_ddoxer, @moutonplacide, @JasonMilletary,@Ring0x0, @precisionsec, @Techhelplistcom, @pollo290987, @MalHunters, @coldshell, @0x7fff9 and @MalwareSecrets for sharing the mcconfs.