Weekly TrickBot Analysis - End of w/c 19-Mar-2018 to A-1000155 and B-1000068

Here are the results of my analysis of TrickBot Banking Trojan mcconfs shared up to the end of the week commencing 19th March 2018. This analysis covers 1,868 unique C2 IP addresses used in 353 mcconfs across 193 versions, with highest versions of A-1000155 and B-1000068.

The following graph shows the rate of discovery of TrickBot versions in the wild, based on shared mcconfs. (Note: The flatter the line, the more frequently versions are discovered.)

Eight new versions were discovered in the week commencing 19th March 2018 (A-1000148, A-1000149, A-1000150, A-1000151, A-1000152, A-1000153, A-1000154, and A-1000155), six the week before, and four the week before that. All eight of the discovered versions extend the original iteration of version numbers (which I refer to as iteration A), taking this to 1000155. The secondary botnet, which is reusing earlier version numbers, was not extended in the discovered versions and remains unchanged for three weeks. (I track these as part of a new, distinct iteration, iteration B, of the version numbers.)

The following graph shows the number of server entries using ports:

• 443 (HTTPS);
• 444 (Simple Network Paging Protocol) -- INACTIVE;
• 445 (IBM AS Server Mapper) -- INACTIVE;
• 449 (Cray Network Semaphore Server); and 
• 451 (SMB) -- INACTIVE.

This week's iteration A configs' command and control (C2) server lists were shortened to 10 servers for several versions before returning to a comparable length to those of the last three weeks'. Most notably, last week two :449 servers were switched to :451 (SMB) servers on the same IP address. After two versions using :451 these two servers were this week switched to :443 (HTTPS) on the same IP address, and remained using this port throughout the week's versions.

The following table shows the top 25 servers (of  1,815 unique) used within the 185 versions. There were no changes from last week.

The following table shows the breakdown of detected TrickBot campaign 'gtag' (group tags) values used in the 353 mcconfs analysed. 

62 C2 servers were used in the mcconfs from this week, of which 55 (89%) were new. The BGP prefix registrations for the C2 server IP addresses continue to be heavily biased to ASN routed through RU (and so the graph below's Y-axis is cut short to allow clearer viewing of other country counts). The new servers' IP addresses are associated with ASN routed to: 24xRU, 14xUA, 10xPL, 4xFR, 1xBG, 1xKZ, and 1xSE.

The following map shows the geographical location of 44 (those with location data) of 45 (scanned by Shodan) of the 62 C2 servers used in the analysed configs.

According to Shodan's most recent data:

• 8 are MikroTik devices, 1 is an ER-X device, 1 is an N5N device, and 1 is an NB5 device.
• 17 are running nginx, 16 are running OpenSSH, nine are running Apache, four are running Dropbear SSH, four are running Exim, four are running MySQL, two are running Postfix, two are running VNC, and one is running Pure FTP.

The following table shows the BGP allocations of C2 servers' IP addresses to country by TrickBot version.

Finally, the following table shows the top 25 BGP prefixes used by TrickBot for C2 servers.

Full size versions of the images included in this post are available here.

Thanks to @mpvillafranca94, @JR0driguezB, @0bscureC0de, @virsoz, @spalomaresg, @VK_Intel, @K_N1kolenko, @hasherezade, @botNET___, @ArnaudDlms, @StackGazer,@voidm4p, @James_inthe_box, @MakFLwana, @_ddoxer, @moutonplacide, @JasonMilletary,@Ring0x0, @precisionsec, @Techhelplistcom, @pollo290987, @MalHunters, @coldshell, @0x7fff9 and @MalwareSecrets for sharing the mcconfs.

Weekly TrickBot Analysis - End of w/c 12-Mar-2018 to A-1000147 and B-1000068

Here are the results of my analysis of TrickBot Banking Trojan mcconfs shared up to the end of the week commencing 12th March 2018. This analysis covers 1,815 unique C2 IP addresses used in 343 mcconfs across 185 versions, with highest versions of A-1000147 and B-1000068.

The following graph shows the rate of discovery of TrickBot versions in the wild, based on shared mcconfs. (Note: The flatter the line, the more frequently versions are discovered.)

Six new versions were discovered in the week commencing 12th March 2018 (A-1000142, A-1000143, A-1000144, A-1000145, A-1000146, and A-1000147), four the week before, and nine the week before that. All six of the discovered versions extend the original iteration of version numbers (which I refer to as iteration A), taking this to 1000147. The secondary botnet, which is reusing earlier version numbers, was not extended in the discovered versions and remains unchanged for two weeks. (I track these as part of a new, distinct iteration, iteration B, of the version numbers.)

The following graph shows the number of server entries using ports:

• 443 (HTTPS);
• 444 (Simple Network Paging Protocol) -- INACTIVE;
• 445 (IBM AS Server Mapper) -- INACTIVE;
• 449 (Cray Network Semaphore Server); and 
• 451 (SMB).

This week's iteration A configs' command and control (C2) server lists were mostly comparable to those of the last few weeks'; however, the number of :449 (Cray Network Semaphore Server) servers returned to two or three. Notably, two of the :449 servers were switched to :451 (SMB) servers on the same IP address in version 1000147. This change reintroduced port :451, which has been absent since version 1000111 from January 1st.

The following table shows the top 25 servers (of  1,815 unique) used within the 185 versions. 212[.]14[.]51[.]43 and 212[.]14[.]51[.]56 increased in the number of uses, but otherwise the table is unchanged from last week.

The following table shows the breakdown of detected TrickBot campaign 'gtag' (group tags) values used in the 343 mcconfs analysed. 

62 C2 servers were used in the mcconfs from this week, of which 56 (90%) were new. The BGP prefix registrations for the C2 server IP addresses continue to be heavily biased to ASN routed through RU (and so the graph below's Y-axis is cut short to allow clearer viewing of other country counts). The new servers' IP addresses are associated with ASN routed to: 29xRU, 7xUA, 5xGB, 4xFR, 3xNL, 3xUS, 2xPA, 2xPL, and 1xCH.

The following map shows the geographical location of 36 (those with location data) of 38 (scanned by Shodan) of the 62 C2 servers used in the analysed configs.

According to Shodan's most recent data:

• 16 are running OpenSSH, 9 are running nginx, four are running Dropbear SSH, one is running Apache, one is running MySQL,  and one is running Postfix.

The following table shows the BGP allocations of C2 servers' IP addresses to country by TrickBot version.

Finally, the following table shows the top 25 BGP prefixes used by TrickBot for C2 servers.

Full size versions of the images included in this post are available here.

Thanks to @mpvillafranca94, @JR0driguezB, @0bscureC0de, @virsoz, @spalomaresg, @VK_Intel, @K_N1kolenko, @hasherezade, @botNET___, @ArnaudDlms, @StackGazer,@voidm4p, @James_inthe_box, @MakFLwana, @_ddoxer, @moutonplacide, @JasonMilletary,@Ring0x0, @precisionsec, @Techhelplistcom, @pollo290987, @MalHunters, @coldshell, @0x7fff9 and @MalwareSecrets for sharing the mcconfs.

Weekly TrickBot Analysis - End of w/c 05-Mar-2018 to A-1000141 and B-1000068

Here are the results of my analysis of TrickBot Banking Trojan mcconfs shared up to the end of the week commencing 5th March 2018. This analysis covers 1,761 unique C2 IP addresses used in 337 mcconfs across 179 versions, with highest versions of A-1000141 and B-1000068.

The following graph shows the rate of discovery of TrickBot versions in the wild, based on shared mcconfs. (Note: The flatter the line, the more frequently versions are discovered.)

Four new versions were discovered in the week commencing 5th March 2018 (A-1000138, A-1000139, A-1000140, and A-1000141), nine the week before, and eleven the week before that. All four of the discovered versions extend the original iteration of version numbers (which I refer to as iteration A), taking this to 1000141. The secondary botnet which is reusing earlier version numbers, was not extended in the discovered versions. (I track these as part of a new, distinct iteration, iteration B, of the version numbers.)

The following graph shows the number of server entries using ports:

• 443 (HTTPS);
• 444 (Simple Network Paging Protocol) -- INACTIVE;
• 445 (IBM AS Server Mapper) -- INACTIVE;
• 449 (Cray Network Semaphore Server); and 
• 451 (SMB) -- INACTIVE.

This week's iteration A configs' command and control (C2) server lists were slightly shorter than the last few weeks', with the number of :449 servers decreased to 0 in the most recent version.

The following table shows the top 25 servers (of  1,761 unique) used within the 179 versions. 212[.]14[.]51[.]43 and 212[.]14[.]51[.]56 moved up into 1st and 2nd place from 2nd and 3rd last week.

The following table shows the breakdown of detected TrickBot campaign 'gtag' (group tags) values used in the 337 mcconfs analysed. 

50 C2 servers were used in the mcconfs from this week, of which 39 (78%) were new. The BGP prefix registrations for the C2 server IP addresses continue to be heavily biased to ASN routed through RU (and so the graph below's Y-axis is cut short to allow clearer viewing of other country counts). The new servers' IP addresses are associated with ASN routed to: 33xRU, 5xNL, and 1xFR.

The following map shows the geographical location of 26 (those with location data) of 34 (scanned by Shodan) of the 50 C2 servers used in the analysed configs.

According to Shodan's most recent data:

• 19 are running OpenSSH, 9 are running nginx, five are running Apache, four are running Exim, three are running MySQL, two are running Dropbear SSH, and one is running Postfix.

The following table shows the BGP allocations of C2 servers' IP addresses to country by TrickBot version.

Finally, the following table shows the top 25 BGP prefixes used by TrickBot for C2 servers.

Full size versions of the images included in this post are available here.

Thanks to @mpvillafranca94, @JR0driguezB, @0bscureC0de, @virsoz, @spalomaresg, @VK_Intel, @K_N1kolenko, @hasherezade, @botNET___, @ArnaudDlms, @StackGazer,@voidm4p, @James_inthe_box, @MakFLwana, @_ddoxer, @moutonplacide, @JasonMilletary,@Ring0x0, @precisionsec, @Techhelplistcom, @pollo290987, @MalHunters, @coldshell, @0x7fff9 and @MalwareSecrets for sharing the mcconfs.

Weekly TrickBot Analysis - End of w/c 26-Feb-2018 to A-1000137 and B-1000068

Here are the results of my analysis of TrickBot Banking Trojan mcconfs shared up to the end of the week commencing 26th February 2018. This analysis covers 1,722 unique C2 IP addresses used in 332 mcconfs across 176 versions, with highest versions of A-1000137 and B-1000068.

The following graph shows the rate of discovery of TrickBot versions in the wild, based on shared mcconfs. (Note: The flatter the line, the more frequently versions are discovered.)

Nine new versions were discovered in the week commencing 26th February 2018 (A-1000134, A-1000135, A-1000137, B-1000062, B-1000063, B-1000064, B-1000065, B-1000067, and B-1000068), eleven the week before, and thirteen the week before that. Three of the discovered versions extend the original iteration of version numbers (which I refer to as iteration A), taking this to 1000137. Six shared versions extend the secondary botnet which is reusing earlier version numbers, taking them to 1000068. (I track these as part of a new, distinct iteration, iteration B, of the version numbers.) The graph clearly shows that the secondary botnet iteration B versions are being published at a far faster rate than the original iteration As.

In addition to the above, an unusual version config was shared with a version number of 4321123. While this is the same length as previously used versions, it is clearly dissociated from either iteration A or B. The actual config for this version had a gtag of 'tm26' and contained a command and control server list which was a duplicate of that used in B-1000063. It is unclear where this single mcconf fits into the existing campaigns at this time, and so it is not used in further analysis.

The following graph shows the number of server entries using ports:

• 443 (HTTPS);
• 444 (Simple Network Paging Protocol) -- INACTIVE;
• 445 (IBM AS Server Mapper) -- INACTIVE;
• 449 (Cray Network Semaphore Server); and 
• 451 (SMB) -- INACTIVE.

This week's iteration A configs' command and control (C2) server lists were similar length to last week's, although the proportion of :449 servers (compared to :443) decreased again. The iteration B configs reduced in length after previous trending towards 20. Additionally, the brief use of port 444 (Simple Network Paging Protocol) halted with that single C2 server removed.

The following table shows the top 25 servers (of  1,722 unique) used within the 176 versions. Most notably, 212[.]14[.]51[.]43 and 212[.]14[.]51[.]56 moved up into 2nd and 3rd place. Additionally, 194[.]87[.]234[.]190 jumped straight into the middle of the table following a recent push of use.

The following table shows the breakdown of detected TrickBot campaign 'gtag' (group tags) values used in the 332 mcconfs analysed. 

100 C2 servers were used in the mcconfs from this week, of which 85 (85%) were new. The BGP prefix registrations for the C2 server IP addresses continue to be heavily biased to ASN routed through RU (and so the graph below's Y-axis is cut short to allow clearer viewing of other country counts). The new servers' IP addresses are associated with ASN routed to: 59xRU, 8xUA, 7xGB, 7xUS, 3xNL, and 1xBG.

The following map shows the geographical location of 72 (those with location data) of 75 (scanned by Shodan) of the 100 C2 servers used in the analysed configs.

According to Shodan's most recent data:

• 50 are running OpenSSH, 26 are running nginx, seven are running Exim, five are running Apache, three are running MySQL, three are running Postfix, two are running Dropbear SSH, and one is running Pure-FTP.

The following table shows the BGP allocations of C2 servers' IP addresses to country by TrickBot version.

Finally, the following table shows the top 25 BGP prefixes used by TrickBot for C2 servers.

Full size versions of the images included in this post are available here.

Thanks to @mpvillafranca94, @JR0driguezB, @0bscureC0de, @virsoz, @spalomaresg, @VK_Intel, @K_N1kolenko, @hasherezade, @botNET___, @ArnaudDlms, @StackGazer,@voidm4p, @James_inthe_box, @MakFLwana, @_ddoxer, @moutonplacide, @JasonMilletary,@Ring0x0, @precisionsec, @Techhelplistcom, @pollo290987, @MalHunters, @coldshell, @0x7fff9 and @MalwareSecrets for sharing the mcconfs.

Weekly TrickBot Analysis - End of w/c 19-Feb-2018 to A-1000133 and B-1000061

Here are the results of my analysis of TrickBot Banking Trojan mcconfs shared up to the end of the week commencing 19th February 2018. This analysis covers 1,637 unique C2 IP addresses used in 322 mcconfs across 166 versions, with a highest version of A-1000133 and B-1000061.

The following graph shows the rate of discovery of TrickBot versions in the wild, based on shared mcconfs. (Note: The flatter the line, the more frequently versions are discovered.)

Eleven new versions were discovered in the week commencing 19th February 2018 (A-1000131, A-1000132, A-1000133, B-1000052, B-1000054, B-1000055, B-1000056, B-1000057, B-1000058, B-1000059, and B-1000061), thirteen the week before, and nine the week before that. Three of the discovered versions extend the original iteration of version numbers (which I refer to as iteration A), taking this to 1000133. Eight shared versions extend the secondary botnet which is reusing earlier version numbers, taking them to 1000061. (I track these as part of a new, distinct iteration, iteration B, of the version numbers.)

The following graph shows the number of server entries using ports:

• 443 (HTTPS);
• 444 (Simple Network Paging Protocol);
• 445 (IBM AS Server Mapper) -- INACTIVE;
• 449 (Cray Network Semaphore Server); and 
• 451 (SMB) -- INACTIVE.

This week's iteration A configs' command and control (C2) server lists increased in length slightly, but remain short compared to previous months. The iteration B configs show a pattern of fluctuating toward a count of 20 C2 servers; however, they introduced a new port, 444 (Simple Network Paging Protocol), to the last three versions. It is unclear at this time if this is a typographical error (such errors have been seen before) or a new development.

The following table shows the top 25 servers (of  1,637 unique) used within the 166 versions. The table involves some shuffling at the top, with a few new entries near the bottom. However, in part this is driven by some older configs that were shared.

The following table shows the breakdown of detected TrickBot campaign 'gtag' (group tags) values used in the 322 mcconfs analysed. 

92 C2 servers were used in the mcconfs from this week, of which 71 (77%) were new. The BGP prefix registrations for the C2 server IP addresses continue to be heavily biased to ASN routed through RU (and so the graph below's Y-axis is cut short to allow clearer viewing of other country counts). The new servers' IP addresses are associated with ASN routed to: 45xRU, 9xUA, 5xGB, 3xUS, 3xFR, 2xEE, 2xNL, 1xLU, and 1xPA.

The following map shows the geographical location of 71 (those with location data) of 74 (scanned by Shodan) of the 92 C2 servers used in the analysed configs.

According to Shodan's most recent data:

• 50 are running OpenSSH, 19 are running nginx, four are running Exim, three are running Apache, three are running Dropbear SSH, two are running Postfix, and one is running PostgreSQL.

The following table shows the BGP allocations of C2 servers' IP addresses to country by TrickBot version.

Finally, the following table shows the top 25 BGP prefixes used by TrickBot for C2 servers.

Full size versions of the images included in this post are available here.

Thanks to @mpvillafranca94, @JR0driguezB, @0bscureC0de, @virsoz, @spalomaresg, @VK_Intel, @K_N1kolenko, @hasherezade, @botNET___, @ArnaudDlms, @StackGazer,@voidm4p, @James_inthe_box, @MakFLwana, @_ddoxer, @moutonplacide, @JasonMilletary,@Ring0x0, @precisionsec, @Techhelplistcom, @pollo290987, @MalHunters, @coldshell, @0x7fff9 and @MalwareSecrets for sharing the mcconfs.