Trickbot’s Updated Password-Grabbing Module Targets More Apps, Services

Figure 3. Scanning for stored Git credentials

For OpenSSH, Trickbot manages to search for files under the %USERPROFILE%\.ssh folder to acquire credentials. It matches the strings DSA PRIVATE KEY, RSA PRIVATE KEY, and OPENSSH PRIVATE KEY in the files to scan for and steal private key credentials.

Figure 4. Targeting OpenSSH

Targeting OpenVPN, Trickbot queries the registry key HKEY_CURRENT_USER\Software\OpenVPN-GUI\Configs, which contains user preferences and saved credentials used for OpenVPN connections.

Figure 5. OpenVPN queries

[Read: Trickbot watch: Arrival via redirection URL in spam]

As KeePass Password Manager is a free and open source application, researchers found that the Trickbot sample module searches for the file %APPDATA%\KeePass.config.xml, and parses through the xml to get the DataBasePath (.kdbx).

Figure 6. Parsing through KeePass

The updated module also steals what it calls “Precious Files,” which are private keys (.ppk), SSL certificates (.p12 and .pfx), and crypto wallet files (.dat). Trend Micro researchers noted these with interest as the first three file types can be used for future targeted attacks, while the crypto wallet files can be used for its intrinsic value online.

Figure 7. “Precious Files”

The module queries for .ppk, .pfx and .p12 files in the %USERPROFILE%\Documents, %USERPROFILE%\Downloads, and %USERPROFILE%\.ssh, while .dat files of bitcoin and litecoin are targeted in %APPDATA%\bitcoin and %APPDATA%\litecoin folders.

Trend Micro solutions

Because of its modular nature, Trickbot can and will surely morph into something more in order to add to its features, and cybercriminals will surely look into other possible iterations to make a profit. To address this challenge, enterprises can look into sourcing third-party security services offering managed detection and response (MDR), such as Trend Micro™ Managed XDR, which offers a wide scope of visibility and expert security analytics by integrating detection and response functions across networks, endpoints, emails, servers, and cloud workloads. Organizations will have access to the whole knowledge base of Trend Micro, including prior analysis of other Trickbot variants and other similarly sophisticated threats.

Moreover, enterprises can benefit from security technology that employs a multilayered approach to mitigate the risks brought by threats like Trickbot. Trend Micro XGen™ security provides a cross-generational blend of threat defense techniques to protect systems from all types of threats, including banking trojans, ransomware, and cryptocurrency-mining malware. It features high-fidelity machine learning on gateways and endpoints, and protects physical, virtual, and cloud workloads. With capabilities like web/URL filtering, behavioral analysis, and custom sandboxing, XGen security protects against today’s threats with various capabilities: bypassing traditional controls; exploiting known, unknown, or undisclosed vulnerabilities; or stealing or encrypting personally identifiable data. Smart, optimized, and connected, XGen security powers Trend Micro’s suite of security solutions.

Additional insights by Augusto Remillano II and Carl Maverick Pascual