Sunday 27 May 2018

Weekly TrickBot Analysis - End of w/c 21-May-2018 to A-1000200, B-1000068, and C-1000198

Here are the results of my analysis of TrickBot Banking Trojan mcconfs shared up to the end of the week commencing 21st May 2018. This analysis covers 2,311 unique C2 IP addresses used in 437 mcconfs across 253 versions, with highest versions of A-1000200, B-1000068, and C-1000198.

Since its first use in approximately October 2016, TrickBot has frequently issued new versions of its XML configuration file, mcconf. Originally there was a single chain of config versions which started at 1000002. (There may have been a 1000001 but it is not been shared publicly.) I refer to this original sequence as iteration A. In November 2017 TrickBot mcconfs were issued for older version numbers than the current iteration A configs, but with different command and control (C2) servers to those in that version's iteration A config. This indicated the start of iteration B, a new sequence of configs believed to be for a second botnet. While there is a small amount of overlap of the C2 servers between iteration A and iteration B, the majority of C2 servers are specific to an iteration (hence botnet). As of late March 2018 another iteration, iteration C, was started, once again repeating previously used version numbers but with different C2 server lists. This week victim hosts in that third botnet were merged into the iteration A botnet.

The following graph shows the rate of discovery of TrickBot versions in the wild, based on shared mcconfs. The flatter the line, the more frequently versions are discovered. Ignore the two long, almost vertical lines which coincide with the switch from one iteration to the next. These vertical lines are purely an artefact of graphing the data in a single series. (Note: Full size versions of all the graphs and tables are available via the link at the end of this post.)

There were six new config versions discovered in the week commencing 21st May 2018 (A-1000196, A-1000197, A-1000198, A-1000199, A-1000200, and C-1000198), three the week before, and three the week before that. Five of the six new config versions extend the iteration A botnet, taking this to 1000200. The secondary, iteration B, botnet was not extended in the discovered versions and remains unchanged since 1000068 of 28th February 2018. The tertiary, iteration C, botnet was merged into the iteration A botnet by updating its configuration direct from 1000185 to the same 1000198 seen in iteration A (well done to JR0driguezB for first spotting this).


TrickBot Version Discovery Dates

The following graph shows the number of server entries using ports:
  • 443 (HTTPS);
  • 444 (Simple Network Paging Protocol) -- INACTIVE;
  • 445 (IBM AS Server Mapper) -- INACTIVE;
  • 449 (Cray Network Semaphore Server); and 
  • 451 (SMB) -- INACTIVE.
In the last month the length of the C2 server lists has stabilised. In the case of iteration A, its C2 server lists have contained approximately 30 server entries. The iteration C server lists have remained, like the iteration B lists, at approximately 20 entries until the 1000198 config which merged those hosts with iteration A.

TrickBot SRV Port Usage

The following table shows the top 25 servers (of  2,311 unique) used within the 253 versions. This week's top three entries moved up from fourth, fifth, and sixth, while the 19th and 20th were new to the top 25.

TrickBot Top 25 SRV

The following table shows the breakdown of detected TrickBot campaign 'gtag' (group tags) values used in the 437 mcconfs analysed. (Yes, I know it's unreadable - it's just here as a guide to show what's in the downloadable zip file at the bottom of the post.)


TrickBot gtag Breakdown

56 C2 servers were used in the mcconfs from this week, of which 23 (41%) were new. The following graph shows the proportional server count of mcconfs shared each week (when compared to the greatest count in a week), along with the percentage churn of the servers.

TrickBot SRV Count and Churn

The BGP prefix registrations for the C2 server IP addresses continue to be heavily biased to ASN routed through RU (and so the graph below's Y-axis is cut short to allow clearer viewing of other country counts). The new servers' IP addresses are associated with ASN routed to: 12xRU, 3xPL, 2xUA, 2xUS, 1xCN, 1xCW, 1xIN, and 1xNL.

TrickBot SRV IP Address BGP Prefix Country Codes

The following map shows the geographical location of 45 (those with location data) of 45 (scanned by Shodan) of the 56 C2 server IP addresses used in the analysed configs.

According to Shodan's most recent data:
  • 19 are Ubiquiti devices.
  • 22 are running Dropbear SSH, 13 are running OpenSSH, 10 are running nginx, five are running Apache, and five are running Exim.
TrickBot C2 Server IP Locations For New Configs

The following table shows the BGP allocations of C2 servers' IP addresses to country by TrickBot version. (Once again, I know it's unreadable - it's just here as a guide to show what's in the downloadable zip file at the bottom of the post.)

TrickBot SRV IP Address BGP Prefix Country Codes By Version

Finally, the following table shows the top 25 BGP prefixes used by TrickBot for C2 servers.

TrickBot Top 25 BGP Prefixes

Full size versions of the images included in this post are available here. I've also created a page documenting the various discrepancies identified in TrickBot's mcconf files.

Thanks to hasherezade, mpvillafranca94, JR0driguezB, 0bscureC0de, VK_Intel, K_N1kolenko, botNET___, ArnaudDlms, StackGazer, voidm4p, James_inthe_box, MakFLwana, _ddoxer, spalomaresg, virsoz, moutonplacide, JasonMilletary, Ring0x0, precisionsec, Techhelplistcom, pollo290987, MalHunters, coldshell, 0x7fff9, kobebryamV2, dvk01uk, benkow_, MalwareSecrets, and SaurabhSha15.

Monday 21 May 2018

Weekly TrickBot Analysis - End of w/c 14-May-2018 to A-1000195, B-1000068, and C-1000185

Here are the results of my analysis of TrickBot Banking Trojan mcconfs shared up to the end of the week commencing 14th May 2018. This analysis covers 2,288 unique C2 IP addresses used in 430 mcconfs across 247 versions, with highest versions of A-1000195, B-1000068, and C-1000185.

Since its first use in approximately October 2016, TrickBot has frequently issued new versions of its XML configuration file, mcconf. Originally there was a single chain of config versions which started at 1000002. (There may have been a 1000001 but it is not been shared publicly.) I refer to this original sequence as iteration A. In November 2017 TrickBot mcconfs were issued for older version numbers than the current iteration A configs, but with different command and control (C2) servers to those in that version's iteration A config. This indicated the start of iteration B, a new sequence of configs believed to be for a second botnet. While there is some overlap of the C2 servers between iteration A and iteration B, the majority of C2 servers are specific to an iteration (hence botnet). As of late March 2018 another iteration, iteration C, was started, once again repeating previously used version numbers but with different C2 server lists.

The following graph shows the rate of discovery of TrickBot versions in the wild, based on shared mcconfs. The flatter the line, the more frequently versions are discovered. Ignore the long almost vertical lines which coincide with the switch from one iteration to the next. These vertical lines are purely an artefact of graphing the data in a single series. (Note: Full size versions of all the graphs and tables are available via the link at the end of this post.)

There were three new config versions discovered in the week commencing 14th May 2018 (A-1000193, A-1000194, and A-1000195), three the week before, and six the week before that. All of the three new config versions extend the iteration A botnet, taking this to 1000195. The secondary, iteration B, botnet was not extended in the discovered versions and remains unchanged since 1000068 of 28th February 2018. The tertiary, iteration C, botnet was also not extended in the discovered versions and remains unchanged since the 1st May 2018 at 1000185.


TrickBot Version Discovery Dates

The following graph shows the number of server entries using ports:
  • 443 (HTTPS);
  • 444 (Simple Network Paging Protocol) -- INACTIVE;
  • 445 (IBM AS Server Mapper) -- INACTIVE;
  • 449 (Cray Network Semaphore Server); and 
  • 451 (SMB) -- INACTIVE.
In the last month the length of the C2 server lists has stabilised. In the case of iteration A, its C2 server lists have contained approximately 30 server entries.

TrickBot SRV Port Usage

The following table shows the top 25 servers (of  2,288 unique) used within the 247 versions. This week the top four and bottom 16 of the table remained static, while there was some minor reordering between position 5 and 9.

TrickBot Top 25 SRV

The following table shows the breakdown of detected TrickBot campaign 'gtag' (group tags) values used in the 430 mcconfs analysed. (Yes, I know it's unreadable - it's just here as a guide to show what's in the downloadable zip file at the bottom of the post.)


TrickBot gtag Breakdown

58 C2 servers were used in the mcconfs from this week, of which 34 (59%) were new. The following graph shows the proportional server count of mcconfs shared each week (when compared to the greatest count in a week), along with the percentage churn of the servers.

TrickBot SRV Count and Churn

The BGP prefix registrations for the C2 server IP addresses continue to be heavily biased to ASN routed through RU (and so the graph below's Y-axis is cut short to allow clearer viewing of other country counts). The new servers' IP addresses are associated with ASN routed to: 16xRU, 4xUA, 2xAU, 2xCA, 2xIN, 2xLU, 1xBR, 1xCZ, 1xES, 1xPL, 1xTJ, and 1xUS.

TrickBot SRV IP Address BGP Prefix Country Codes

The following map shows the geographical location of 53 (those with location data) of 53 (scanned by Shodan) of the 58 C2 server IP addresses used in the analysed configs.

According to Shodan's most recent data:
  • 19 are Ubiquiti devices.
  • 24 are running Dropbear SSH, 20 are running OpenSSH, 14 are running nginx, 11 are running Apache, 7 are running Exim, two are running MySQL, one is running Postfix, and one is running ProFTP.
TrickBot C2 Server IP Locations For New Configs

The following table shows the BGP allocations of C2 servers' IP addresses to country by TrickBot version. (Once again, I know it's unreadable - it's just here as a guide to show what's in the downloadable zip file at the bottom of the post.)

TrickBot SRV IP Address BGP Prefix Country Codes By Version

Finally, the following table shows the top 25 BGP prefixes used by TrickBot for C2 servers.

TrickBot Top 25 BGP Prefixes

Full size versions of the images included in this post are available here. I've also created a page documenting the various discrepancies identified in TrickBot's mcconf files.

Thanks to hasherezade, mpvillafranca94, JR0driguezB, 0bscureC0de, VK_Intel, K_N1kolenko, botNET___, ArnaudDlms, StackGazer, voidm4p, James_inthe_box, MakFLwana, _ddoxer, spalomaresg, virsoz, moutonplacide, JasonMilletary, Ring0x0, precisionsec, Techhelplistcom, pollo290987, MalHunters, coldshell, 0x7fff9, kobebryamV2, dvk01uk, benkow_, and MalwareSecrets.

Monday 14 May 2018

Weekly TrickBot Analysis - End of w/c 07-May-2018 to A-1000192, B-1000068, and C-1000185

Here are the results of my analysis of TrickBot Banking Trojan mcconfs shared up to the end of the week commencing 7th May 2018. This analysis covers 2,260 unique C2 IP addresses used in 425 mcconfs across 244 versions, with highest versions of A-1000192, B-1000068, and C-1000185.

Since its first use in approximately October 2016, TrickBot has frequently issued new versions of its XML configuration file, mcconf. Originally there was a single chain of config versions which started at 1000002. (There may have been a 1000001 but it is not been shared publicly.) I refer to this original sequence as iteration A. In November 2017 TrickBot mcconfs were issued for older version numbers than the current iteration A configs, but with different command and control (C2) servers to those in that version's iteration A config. This indicated the start of iteration B, a new sequence of configs believed to be for a second botnet. While there is some overlap of the C2 servers between iteration A and iteration B, the majority of C2 servers are specific to an iteration (hence botnet). As of late March 2018 another iteration, iteration C, was started, once again repeating previously used version numbers but with different C2 server lists.

The following graph shows the rate of discovery of TrickBot versions in the wild, based on shared mcconfs. The flatter the line, the more frequently versions are discovered. Ignore the long almost vertical lines which coincide with the switch from one iteration to the next. These vertical lines are purely an artefact of graphing the data in a single series. (Note: Full size versions of all the graphs and tables are available via the link at the end of this post.)

There were three new config versions discovered in the week commencing 7th May 2018 (A-1000190, A-1000191, and A-1000192), six the week before, and 11 the week before that. All of the three new config versions extend the iteration A botnet, taking this to 1000192. The secondary, iteration B, botnet was not extended in the discovered versions and remains unchanged since 1000068 of 28th February 2018. The tertiary, iteration C, botnet was also not extended in the discovered versions and remains unchanged since the previous week at 1000185.


TrickBot Version Discovery Dates

The following graph shows the number of server entries using ports:
  • 443 (HTTPS);
  • 444 (Simple Network Paging Protocol) -- INACTIVE;
  • 445 (IBM AS Server Mapper) -- INACTIVE;
  • 449 (Cray Network Semaphore Server); and 
  • 451 (SMB) -- INACTIVE.
As with the last few weeks, the iteration A configs have fluctuated in length just above 30 C2 servers.

TrickBot SRV Port Usage

The following table shows the top 25 servers (of  2,260 unique) used within the 244 versions. This week the table underwent significant changes, as per the last few weeks. Six of the now top 10 servers were used in iteration A configs from this week, and so moved up from lower in the top 25.

TrickBot Top 25 SRV

The following table shows the breakdown of detected TrickBot campaign 'gtag' (group tags) values used in the 425 mcconfs analysed. (Yes, I know it's unreadable - it's just here as a guide to show what's in the downloadable zip file at the bottom of the post.)


TrickBot gtag Breakdown

50 C2 servers were used in the mcconfs from this week, of which 25 (50%) were new. The following graph shows the proportional server count of mcconfs shared each week (when compared to the greatest count in a week), along with the percentage churn of the servers.

TrickBot SRV Count and Churn

The BGP prefix registrations for the C2 server IP addresses continue to be heavily biased to ASN routed through RU (and so the graph below's Y-axis is cut short to allow clearer viewing of other country counts). The new servers' IP addresses are associated with ASN routed to: 9xRU, 5xUA, 4xLU, 3xNL, 2xCA, 1xAU, and 1xSI.

TrickBot SRV IP Address BGP Prefix Country Codes

The following map shows the geographical location of 44 (those with location data) of 44 (scanned by Shodan) of the 50 C2 server IP addresses used in the analysed configs.

According to Shodan's most recent data:
  • 14 are Ubiquiti devices.
  • 21 are running Dropbear SSH, 14 are running OpenSSH, seven are running nginx, five are running Apache, three are running Exim, two are running Postfix, and one is running ProFTP.
TrickBot C2 Server IP Locations For New Configs

The following table shows the BGP allocations of C2 servers' IP addresses to country by TrickBot version. (Once again, I know it's unreadable - it's just here as a guide to show what's in the downloadable zip file at the bottom of the post.)

TrickBot SRV IP Address BGP Prefix Country Codes By Version

Finally, the following table shows the top 25 BGP prefixes used by TrickBot for C2 servers.

TrickBot Top 25 BGP Prefixes

Full size versions of the images included in this post are available here. I've also created a page documenting the various discrepancies identified in TrickBot's mcconf files.

Thanks to @hasherezade, @mpvillafranca94, @JR0driguezB, @0bscureC0de, @virsoz, @spalomaresg, @VK_Intel, @K_N1kolenko, @botNET___, @ArnaudDlms, @StackGazer,@voidm4p, @James_inthe_box, @MakFLwana, @_ddoxer, @moutonplacide, @JasonMilletary,@Ring0x0, @precisionsec, @Techhelplistcom, @pollo290987, @MalHunters, @coldshell, @0x7fff9, @kobebryamV2, and @MalwareSecrets for sharing the mcconfs.

Monday 7 May 2018

Weekly TrickBot Analysis - End of w/c 30-Apr-2018 to A-1000189, B-1000068, and C-1000185

Here are the results of my analysis of TrickBot Banking Trojan mcconfs shared up to the end of the week commencing 30th April 2018. This analysis covers 2,235 unique C2 IP addresses used in 421 mcconfs across 241 versions, with highest versions of A-1000189, B-1000068, and C-1000185.

Since its first use in approximately October 2016, TrickBot has frequently issued new versions of its XML configuration file, mcconf. Originally there was a single chain of config versions which started at 1000002. (There may have been a 1000001 but it is not been shared publicly.) I refer to this original sequence as iteration A. In November 2017 TrickBot mcconfs were issued for older version numbers than the current iteration A configs, but with different command and control (C2) servers to those in that version's iteration A config. This indicated the start of iteration B, a new sequence of configs believed to be for a second botnet. While there is some overlap of the C2 servers between iteration A and iteration B, the majority of C2 servers are specific to an iteration (hence botnet). As of late March 2018 another iteration, iteration C, was started, once again repeating previously used version numbers but with different C2 server lists.

The following graph shows the rate of discovery of TrickBot versions in the wild, based on shared mcconfs. The flatter the line, the more frequently versions are discovered. Ignore the long almost vertical lines which coincide with the switch from one iteration to the next. These vertical lines are purely an artefact of graphing the data in a single series. (Note: Full size versions of all the graphs and tables are available via the link at the end of this post.)

There were six new config versions discovered in the week commencing 30th April 2018 (A-1000187, A-1000188, A-1000189, C-1000183, C-1000184, and C-1000185), 11 the week before, and 11 the week before that. Of the six new config versions, three extend the iteration A botnet, taking this to 1000189. The secondary, iteration B, botnet was not extended in the discovered versions and remains unchanged since 1000068 of 28th February 2018. Three of the new config versions continue the tertiary, iteration C, botnet, taking it to 1000185.


TrickBot Version Discovery Dates

The following graph shows the number of server entries using ports:
  • 443 (HTTPS);
  • 444 (Simple Network Paging Protocol) -- INACTIVE;
  • 445 (IBM AS Server Mapper) -- INACTIVE;
  • 449 (Cray Network Semaphore Server); and 
  • 451 (SMB) -- INACTIVE.
As with the last few weeks, the iteration A configs have fluctuated in length at around 30 C2 servers. This week they reached 33 servers, a high not seen since December 2017. The iteration C configs continue at similar lengths to the iteration B ones from earlier in the year. So far, with a cap of 20 C2 servers in their lists and only :443 (HTTPS) servers used.

TrickBot SRV Port Usage

The following table shows the top 25 servers (of  2,235 unique) used within the 241 versions. This week the table underwent significant changes, as with last week. Nine of the servers were used in iteration A configs from this week, and so these all moved up the middle of the table.

TrickBot Top 25 SRV

The following table shows the breakdown of detected TrickBot campaign 'gtag' (group tags) values used in the 421 mcconfs analysed. (Yes, I know it's unreadable - it's just here as a guide to show what's in the downloadable zip file at the bottom of the post.)


TrickBot gtag Breakdown

71 C2 servers were used in the mcconfs from this week, of which 33 (46%) were new. The BGP prefix registrations for the C2 server IP addresses continue to be heavily biased to ASN routed through RU (and so the graph below's Y-axis is cut short to allow clearer viewing of other country counts). The new servers' IP addresses are associated with ASN routed to: 18xRU, 6xUA, 2xBG, 1xBR, 1xCZ, 1xFR, 1xIN, 1xLT, 1xNL, and 1xUS.

TrickBot SRV IP Address BGP Prefix Country Codes

The following map shows the geographical location of 61 (those with location data) of 61 (scanned by Shodan) of the 71 C2 server IP addresses used in the analysed configs.

According to Shodan's most recent data:
  • 12 are Ubiquiti devices.
  • 28 are running OpenSSH, 19 are running Dropbear SSH, 17 are running nginx, seven are running Apache, three are running IIS, two are running Exim, two are running Pure FTP, one is running MailEnable, and one is running MySQL.
TrickBot C2 Server IP Locations For New Configs

The following table shows the BGP allocations of C2 servers' IP addresses to country by TrickBot version. (Once again, I know it's unreadable - it's just here as a guide to show what's in the downloadable zip file at the bottom of the post.)

TrickBot SRV IP Address BGP Prefix Country Codes By Version

Finally, the following table shows the top 25 BGP prefixes used by TrickBot for C2 servers.

TrickBot Top 25 BGP Prefixes

Full size versions of the images included in this post are available here. I've also created a new page documenting the various discrepancies identified in TrickBot's mcconf files.

Thanks to @hasherezade, @mpvillafranca94, @JR0driguezB, @0bscureC0de, @virsoz, @spalomaresg, @VK_Intel, @K_N1kolenko, @botNET___, @ArnaudDlms, @StackGazer,@voidm4p, @James_inthe_box, @MakFLwana, @_ddoxer, @moutonplacide, @JasonMilletary,@Ring0x0, @precisionsec, @Techhelplistcom, @pollo290987, @MalHunters, @coldshell, @0x7fff9, @kobebryamV2, and @MalwareSecrets for sharing the mcconfs.