Since its first use in approximately October 2016, TrickBot has frequently issued new versions of its XML configuration file mcconf. Originally there was a single chain of config versions which started at 1000002. (There may have been a 1000001 but it is not shared publicly.) I refer to this original sequence as iteration A. In November 2017 TrickBot mcconfs were issued for older version numbers than the current iteration A configs, but with different command and control (C2) servers to those in that version's iteration A config. This indicated the start of iteration B, a new sequence of configs believed to be for a second botnet. While there is some overlap of the C2 servers between iteration A and iteration B, the majority of C2 servers are specific to an iteration (hence botnet). As of late March 2018 another iteration, iteration C, was started, once again repeating previously used version numbers but with different C2 server lists.
The following graph shows the rate of discovery of TrickBot versions in the wild, based on shared mcconfs. The flatter the line, the more frequently versions are discovered. Ignore the long almost vertical lines which coincide with the switch from one iteration to the next. These vertical lines are purely an artefact of graphing the data in a single series. (Note: Full size versions of all the graphs and tables are available via the link at the end of this post.)
There were 11 new config versions discovered in the week commencing 23rd April 2018 (A-1000183, A-1000184, A-1000185, A-1000186, C-1000175, C-1000177, C-1000178, C-1000179, C-1000180, C-1000181, and C-1000182), 11 the week before, and six the week before that. Of the 11 new config versions, four extend the iteration A botnet, taking this to 1000186. The secondary, iteration B, botnet was not extended in the discovered versions and remains unchanged since 1000068 of 28th February 2018. of the new config versions continue the tertiary, iteration C, botnet, taking it to 1000182.
- 443 (HTTPS);
- 444 (Simple Network Paging Protocol) -- INACTIVE;
- 445 (IBM AS Server Mapper) -- INACTIVE;
- 449 (Cray Network Semaphore Server); and
- 451 (SMB).
The following map shows the geographical location of 91 (those with location data) of 91 (scanned by Shodan) of the 119 C2 server IP addresses used in the analysed configs.
According to Shodan's most recent data:
The following table shows the BGP allocations of C2 servers' IP addresses to country by TrickBot version. (Once again, I know it's unreadable - it's just here as a guide to show what's in the downloadable zip file at the bottom of the post.)
According to Shodan's most recent data:
- 14 are Ubiquiti devices.
- 47 are running OpenSSH, 18 are running Apache, 18 are running Dropbear SSH, 16 are running nginx, 11 are running Exim, six are running MySQL, two are running Postfix, two are running IIS, one is running Pro FTP, and one is running Pure FTP.
Finally, the following table shows the top 25 BGP prefixes used by TrickBot for C2 servers.
Full size versions of the images included in this post are available here.
Thanks to @hasherezade, @mpvillafranca94, @JR0driguezB, @0bscureC0de, @virsoz, @spalomaresg, @VK_Intel, @K_N1kolenko, @botNET___, @ArnaudDlms, @StackGazer,@voidm4p, @James_inthe_box, @MakFLwana, @_ddoxer, @moutonplacide, @JasonMilletary,@Ring0x0, @precisionsec, @Techhelplistcom, @pollo290987, @MalHunters, @coldshell, @0x7fff9, @kobebryamV2, and @MalwareSecrets for sharing the mcconfs.
Thanks to @hasherezade, @mpvillafranca94, @JR0driguezB, @0bscureC0de, @virsoz, @spalomaresg, @VK_Intel, @K_N1kolenko, @botNET___, @ArnaudDlms, @StackGazer,@voidm4p, @James_inthe_box, @MakFLwana, @_ddoxer, @moutonplacide, @JasonMilletary,@Ring0x0, @precisionsec, @Techhelplistcom, @pollo290987, @MalHunters, @coldshell, @0x7fff9, @kobebryamV2, and @MalwareSecrets for sharing the mcconfs.
