Weekly TrickBot Analysis - End of w/c 02-Apr-2018 to A-1000169 and B-1000068

Here are the results of my analysis of TrickBot Banking Trojan mcconfs shared up to the end of the week commencing 2nd April 2018. This analysis covers 1,969 unique C2 IP addresses used in 374 mcconfs across 206 versions, with highest versions of A-1000169 and B-1000068.

The following graph shows the rate of discovery of TrickBot versions in the wild, based on shared mcconfs. (Note: The flatter the line, the more frequently versions are discovered.)

Seven new versions were discovered in the week commencing 2nd April 2018 (A-1000163, A-1000164, A-1000165, A-1000166, A-1000167, A-1000168, and A-1000169), six the week before, and eight the week before that. All seven of the discovered versions extend the original iteration of version numbers (which I refer to as iteration A), taking this to 1000169. The secondary botnet, which is reusing earlier version numbers, was not extended in the discovered versions and remains unchanged for five weeks. (I track these as part of a new, distinct iteration, iteration B, of the version numbers.)

The following graph shows the number of server entries using ports:

• 443 (HTTPS);
• 444 (Simple Network Paging Protocol) -- INACTIVE;
• 445 (IBM AS Server Mapper) -- INACTIVE;
• 449 (Cray Network Semaphore Server); and 
• 451 (SMB).

Ever since version 1000123, at the start of February, the iteration A configs' command and control (C2) server lists have had a maximum of 21 entries. (The iteration B config's had a similar limit of 22 entries when they were active.) This week's configs continued that approach, although a :451 (SMB) server was re-added, much like the middle of March.

Notably, version 1000160 was seen with two different C2 server lists this week. This has happened only once before, in December 2017, for version 1000105; although in that case it seemed to be a typographical issue (as I discuss here). However, in the recent 1000160 version the two server lists are dramatically different (as I discuss here).

The following table shows the top 25 servers (of  1,969 unique) used within the 206 versions. Server 82[.]214[.]141[.]134:449 jumped up to 4th position this week, with 31[.]134[.]60[.]181:449 and 185[.]55[.]64[.]47:449 also moving up the top 25. 109[.]95[.]113[.]130:449 moved into the top 25, straight into 15th position.

The following table shows the breakdown of detected TrickBot campaign 'gtag' (group tags) values used in the 374 mcconfs analysed. 

77 C2 servers were used in the mcconfs from this week, of which 66 (86%) were new. The BGP prefix registrations for the C2 server IP addresses continue to be heavily biased to ASN routed through RU (and so the graph below's Y-axis is cut short to allow clearer viewing of other country counts). The new servers' IP addresses are associated with ASN routed to: 51xRU, 7xUA, 5xPL, 1xBG, 1xFR, and 1xUS.

The following map shows the geographical location of 62 (those with location data) of 64 (scanned by Shodan) of the 77 C2 servers used in the analysed configs.

According to Shodan's most recent data:

• 10 are MikroTik devices, 4 are Ubiquiti devices.
• 27 are running OpenSSH, 18 are running nginx, 11 are running Apache, eight are running Exim, three are running Dropbear SSH, three are running MySQL, three are running Postfix, one is running Jetty, one is running Pro FTP, one is running Pure FTP, and one is running VNC.

The following table shows the BGP allocations of C2 servers' IP addresses to country by TrickBot version.

Finally, the following table shows the top 25 BGP prefixes used by TrickBot for C2 servers.

Full size versions of the images included in this post are available here.

Thanks to @mpvillafranca94, @JR0driguezB, @0bscureC0de, @virsoz, @spalomaresg, @VK_Intel, @K_N1kolenko, @hasherezade, @botNET___, @ArnaudDlms, @StackGazer,@voidm4p, @James_inthe_box, @MakFLwana, @_ddoxer, @moutonplacide, @JasonMilletary,@Ring0x0, @precisionsec, @Techhelplistcom, @pollo290987, @MalHunters, @coldshell, @0x7fff9 and @MalwareSecrets for sharing the mcconfs.

Adhoc TrickBot Analysis - 1000160

As discussed previously, while TrickBot issues configurations (mcconf) for different campaigns (group tags) under each version number, the command and control (C2) server lists for these campaigns are usually the same for a particular version. In December 2017 a version 1000105 was seen with two different C2 server lists. However, as I discussed the variations looked to be typographical in nature.

Version 1000160, from 28th March 2018, is the only other time (so far shared) that two different C2 server lists have been seen for a single version of mcconf (within a single iteration of the version numbers - see below). However, in this case the two server lists are dramatically different. The test list (and an exact copy used for gtag 'ser0329a') look to continue the iteration A sequence of versions, with C2 servers which share a good number of entries with those from versions 1000159 and 1000161 (as seen in the image below). The config shared by @Ring0x0 for gtag 'uk03-1', however, contains very different servers; and only one of these, 185.146.156.247:443, has been seen at any time before. (The other configs were shared by @JR0driguezB - thanks, as always.)

This variant C2 server list is obviously not a typographical error, and further demonstrates that the threat actors behind TrickBot have the ability (if not normally the need) to distribute custom C2 server lists for individual campaigns, and possibly infections.

Now, the threat actors behind TrickBot already operate two distinct 'botnets' of infections. With the primary iteration of version updates (which I call iteration A) having begun at version 1000002 (if there was a 1000001 then it has never been shared publicly) and continued through 1000160 up to the current latest version of 1000169. In the week commencing 18th December 2017 I identified a second iteration (iteration B) in shared mcconfs, and have since been shared data for 1000013 through 1000068, as shown in the following graph.

It is unlikely that this second version 1000160 config relates to the iteration B botnet. Firstly, iteration B has not been updated since the change to 1000068 on 28th February 2018. Secondly, the jump from 1000068 to 1000160 would skip a large number of version numbers for no obvious reason (although it feasibly could be done in error). Whether it indicates the start of a new iteration is unclear at this time.

***
Update: In fact this second 1000160 config did identify the start of a third infection network; the tracking of this third botnet (iteration C) begins here.
***

Weekly TrickBot Analysis - End of w/c 26-Mar-2018 to A-1000162 and B-1000068

Here are the results of my analysis of TrickBot Banking Trojan mcconfs shared up to the end of the week commencing 26th March 2018. This analysis covers 1,904unique C2 IP addresses used in 360 mcconfs across 199 versions, with highest versions of A-1000162 and B-1000068.

The following graph shows the rate of discovery of TrickBot versions in the wild, based on shared mcconfs. (Note: The flatter the line, the more frequently versions are discovered.)

Six new versions were discovered in the week commencing 26th March 2018 (A-1000157, A-1000158, A-1000159, A-1000160, A-1000161, and A-1000162), eight the week before, and six the week before that. All six of the discovered versions extend the original iteration of version numbers (which I refer to as iteration A), taking this to 1000162. The secondary botnet, which is reusing earlier version numbers, was not extended in the discovered versions and remains unchanged for four weeks. (I track these as part of a new, distinct iteration, iteration B, of the version numbers.)

The following graph shows the number of server entries using ports:

• 443 (HTTPS);
• 444 (Simple Network Paging Protocol) -- INACTIVE;
• 445 (IBM AS Server Mapper) -- INACTIVE;
• 449 (Cray Network Semaphore Server); and 
• 451 (SMB) -- INACTIVE.

Ever since version 1000123, at the start of February, the iteration A configs' command and control (C2) server lists have had a maximum of 21 entries. (The iteration B config's had a similar limit of 22 entries when they were active.) There have been a few fluctuations below the high teens, but overall the average number of servers for iteration A configs has been 17.7 across the 37 most recent versions. The current resurgence in :449 servers continues, all be it the number dropped from 8 to 6 through the last week.

The following table shows the top 25 servers (of  1,904 unique) used within the 199 versions. This table underwent numerous changes since last week, with 6 servers entering the table as they were used multiple times this week.

The following table shows the breakdown of detected TrickBot campaign 'gtag' (group tags) values used in the 360 mcconfs analysed. 

49 C2 servers were used in the mcconfs from this week, of which 36 (73%) were new. The BGP prefix registrations for the C2 server IP addresses continue to be heavily biased to ASN routed through RU (and so the graph below's Y-axis is cut short to allow clearer viewing of other country counts). The new servers' IP addresses are associated with ASN routed to: 23xRU, 7xUA, 3xFR, 2xPL, and 1xNA.

The following map shows the geographical location of 43 (those with location data) of 44 (scanned by Shodan) of the 49 C2 servers used in the analysed configs.

According to Shodan's most recent data:

• 11 are MikroTik devices, 1 is an N5N device, and 1 is an NB5 device.
• 24 are running OpenSSH, 16 are running nginx, seven are running Apache, six are running Exim, three are running MySQL, one is running Dropbear SSH, one is running node.js, one is running Pro FTP, and one is running VNC.

The following table shows the BGP allocations of C2 servers' IP addresses to country by TrickBot version.

Finally, the following table shows the top 25 BGP prefixes used by TrickBot for C2 servers.

Full size versions of the images included in this post are available here.

Thanks to @mpvillafranca94, @JR0driguezB, @0bscureC0de, @virsoz, @spalomaresg, @VK_Intel, @K_N1kolenko, @hasherezade, @botNET___, @ArnaudDlms, @StackGazer,@voidm4p, @James_inthe_box, @MakFLwana, @_ddoxer, @moutonplacide, @JasonMilletary,@Ring0x0, @precisionsec, @Techhelplistcom, @pollo290987, @MalHunters, @coldshell, @0x7fff9 and @MalwareSecrets for sharing the mcconfs.

Weekly TrickBot Analysis - End of w/c 19-Mar-2018 to A-1000155 and B-1000068

Here are the results of my analysis of TrickBot Banking Trojan mcconfs shared up to the end of the week commencing 19th March 2018. This analysis covers 1,868 unique C2 IP addresses used in 353 mcconfs across 193 versions, with highest versions of A-1000155 and B-1000068.

The following graph shows the rate of discovery of TrickBot versions in the wild, based on shared mcconfs. (Note: The flatter the line, the more frequently versions are discovered.)

Eight new versions were discovered in the week commencing 19th March 2018 (A-1000148, A-1000149, A-1000150, A-1000151, A-1000152, A-1000153, A-1000154, and A-1000155), six the week before, and four the week before that. All eight of the discovered versions extend the original iteration of version numbers (which I refer to as iteration A), taking this to 1000155. The secondary botnet, which is reusing earlier version numbers, was not extended in the discovered versions and remains unchanged for three weeks. (I track these as part of a new, distinct iteration, iteration B, of the version numbers.)

The following graph shows the number of server entries using ports:

• 443 (HTTPS);
• 444 (Simple Network Paging Protocol) -- INACTIVE;
• 445 (IBM AS Server Mapper) -- INACTIVE;
• 449 (Cray Network Semaphore Server); and 
• 451 (SMB) -- INACTIVE.

This week's iteration A configs' command and control (C2) server lists were shortened to 10 servers for several versions before returning to a comparable length to those of the last three weeks'. Most notably, last week two :449 servers were switched to :451 (SMB) servers on the same IP address. After two versions using :451 these two servers were this week switched to :443 (HTTPS) on the same IP address, and remained using this port throughout the week's versions.

The following table shows the top 25 servers (of  1,815 unique) used within the 185 versions. There were no changes from last week.

The following table shows the breakdown of detected TrickBot campaign 'gtag' (group tags) values used in the 353 mcconfs analysed. 

62 C2 servers were used in the mcconfs from this week, of which 55 (89%) were new. The BGP prefix registrations for the C2 server IP addresses continue to be heavily biased to ASN routed through RU (and so the graph below's Y-axis is cut short to allow clearer viewing of other country counts). The new servers' IP addresses are associated with ASN routed to: 24xRU, 14xUA, 10xPL, 4xFR, 1xBG, 1xKZ, and 1xSE.

The following map shows the geographical location of 44 (those with location data) of 45 (scanned by Shodan) of the 62 C2 servers used in the analysed configs.

According to Shodan's most recent data:

• 8 are MikroTik devices, 1 is an ER-X device, 1 is an N5N device, and 1 is an NB5 device.
• 17 are running nginx, 16 are running OpenSSH, nine are running Apache, four are running Dropbear SSH, four are running Exim, four are running MySQL, two are running Postfix, two are running VNC, and one is running Pure FTP.

The following table shows the BGP allocations of C2 servers' IP addresses to country by TrickBot version.

Finally, the following table shows the top 25 BGP prefixes used by TrickBot for C2 servers.

Full size versions of the images included in this post are available here.

Thanks to @mpvillafranca94, @JR0driguezB, @0bscureC0de, @virsoz, @spalomaresg, @VK_Intel, @K_N1kolenko, @hasherezade, @botNET___, @ArnaudDlms, @StackGazer,@voidm4p, @James_inthe_box, @MakFLwana, @_ddoxer, @moutonplacide, @JasonMilletary,@Ring0x0, @precisionsec, @Techhelplistcom, @pollo290987, @MalHunters, @coldshell, @0x7fff9 and @MalwareSecrets for sharing the mcconfs.

Weekly TrickBot Analysis - End of w/c 12-Mar-2018 to A-1000147 and B-1000068

Here are the results of my analysis of TrickBot Banking Trojan mcconfs shared up to the end of the week commencing 12th March 2018. This analysis covers 1,815 unique C2 IP addresses used in 343 mcconfs across 185 versions, with highest versions of A-1000147 and B-1000068.

The following graph shows the rate of discovery of TrickBot versions in the wild, based on shared mcconfs. (Note: The flatter the line, the more frequently versions are discovered.)

Six new versions were discovered in the week commencing 12th March 2018 (A-1000142, A-1000143, A-1000144, A-1000145, A-1000146, and A-1000147), four the week before, and nine the week before that. All six of the discovered versions extend the original iteration of version numbers (which I refer to as iteration A), taking this to 1000147. The secondary botnet, which is reusing earlier version numbers, was not extended in the discovered versions and remains unchanged for two weeks. (I track these as part of a new, distinct iteration, iteration B, of the version numbers.)

The following graph shows the number of server entries using ports:

• 443 (HTTPS);
• 444 (Simple Network Paging Protocol) -- INACTIVE;
• 445 (IBM AS Server Mapper) -- INACTIVE;
• 449 (Cray Network Semaphore Server); and 
• 451 (SMB).

This week's iteration A configs' command and control (C2) server lists were mostly comparable to those of the last few weeks'; however, the number of :449 (Cray Network Semaphore Server) servers returned to two or three. Notably, two of the :449 servers were switched to :451 (SMB) servers on the same IP address in version 1000147. This change reintroduced port :451, which has been absent since version 1000111 from January 1st.

The following table shows the top 25 servers (of  1,815 unique) used within the 185 versions. 212[.]14[.]51[.]43 and 212[.]14[.]51[.]56 increased in the number of uses, but otherwise the table is unchanged from last week.

The following table shows the breakdown of detected TrickBot campaign 'gtag' (group tags) values used in the 343 mcconfs analysed. 

62 C2 servers were used in the mcconfs from this week, of which 56 (90%) were new. The BGP prefix registrations for the C2 server IP addresses continue to be heavily biased to ASN routed through RU (and so the graph below's Y-axis is cut short to allow clearer viewing of other country counts). The new servers' IP addresses are associated with ASN routed to: 29xRU, 7xUA, 5xGB, 4xFR, 3xNL, 3xUS, 2xPA, 2xPL, and 1xCH.

The following map shows the geographical location of 36 (those with location data) of 38 (scanned by Shodan) of the 62 C2 servers used in the analysed configs.

According to Shodan's most recent data:

• 16 are running OpenSSH, 9 are running nginx, four are running Dropbear SSH, one is running Apache, one is running MySQL,  and one is running Postfix.

The following table shows the BGP allocations of C2 servers' IP addresses to country by TrickBot version.

Finally, the following table shows the top 25 BGP prefixes used by TrickBot for C2 servers.

Full size versions of the images included in this post are available here.

Thanks to @mpvillafranca94, @JR0driguezB, @0bscureC0de, @virsoz, @spalomaresg, @VK_Intel, @K_N1kolenko, @hasherezade, @botNET___, @ArnaudDlms, @StackGazer,@voidm4p, @James_inthe_box, @MakFLwana, @_ddoxer, @moutonplacide, @JasonMilletary,@Ring0x0, @precisionsec, @Techhelplistcom, @pollo290987, @MalHunters, @coldshell, @0x7fff9 and @MalwareSecrets for sharing the mcconfs.

Weekly TrickBot Analysis - End of w/c 05-Mar-2018 to A-1000141 and B-1000068

Here are the results of my analysis of TrickBot Banking Trojan mcconfs shared up to the end of the week commencing 5th March 2018. This analysis covers 1,761 unique C2 IP addresses used in 337 mcconfs across 179 versions, with highest versions of A-1000141 and B-1000068.

The following graph shows the rate of discovery of TrickBot versions in the wild, based on shared mcconfs. (Note: The flatter the line, the more frequently versions are discovered.)

Four new versions were discovered in the week commencing 5th March 2018 (A-1000138, A-1000139, A-1000140, and A-1000141), nine the week before, and eleven the week before that. All four of the discovered versions extend the original iteration of version numbers (which I refer to as iteration A), taking this to 1000141. The secondary botnet which is reusing earlier version numbers, was not extended in the discovered versions. (I track these as part of a new, distinct iteration, iteration B, of the version numbers.)

The following graph shows the number of server entries using ports:

• 443 (HTTPS);
• 444 (Simple Network Paging Protocol) -- INACTIVE;
• 445 (IBM AS Server Mapper) -- INACTIVE;
• 449 (Cray Network Semaphore Server); and 
• 451 (SMB) -- INACTIVE.

This week's iteration A configs' command and control (C2) server lists were slightly shorter than the last few weeks', with the number of :449 servers decreased to 0 in the most recent version.

The following table shows the top 25 servers (of  1,761 unique) used within the 179 versions. 212[.]14[.]51[.]43 and 212[.]14[.]51[.]56 moved up into 1st and 2nd place from 2nd and 3rd last week.

The following table shows the breakdown of detected TrickBot campaign 'gtag' (group tags) values used in the 337 mcconfs analysed. 

50 C2 servers were used in the mcconfs from this week, of which 39 (78%) were new. The BGP prefix registrations for the C2 server IP addresses continue to be heavily biased to ASN routed through RU (and so the graph below's Y-axis is cut short to allow clearer viewing of other country counts). The new servers' IP addresses are associated with ASN routed to: 33xRU, 5xNL, and 1xFR.

The following map shows the geographical location of 26 (those with location data) of 34 (scanned by Shodan) of the 50 C2 servers used in the analysed configs.

According to Shodan's most recent data:

• 19 are running OpenSSH, 9 are running nginx, five are running Apache, four are running Exim, three are running MySQL, two are running Dropbear SSH, and one is running Postfix.

The following table shows the BGP allocations of C2 servers' IP addresses to country by TrickBot version.

Finally, the following table shows the top 25 BGP prefixes used by TrickBot for C2 servers.

Full size versions of the images included in this post are available here.

Thanks to @mpvillafranca94, @JR0driguezB, @0bscureC0de, @virsoz, @spalomaresg, @VK_Intel, @K_N1kolenko, @hasherezade, @botNET___, @ArnaudDlms, @StackGazer,@voidm4p, @James_inthe_box, @MakFLwana, @_ddoxer, @moutonplacide, @JasonMilletary,@Ring0x0, @precisionsec, @Techhelplistcom, @pollo290987, @MalHunters, @coldshell, @0x7fff9 and @MalwareSecrets for sharing the mcconfs.