MITRE ATT&CKsoftware (malware)
S0266 TrickBot
- Domain
- enterprise
- Platforms
- Windows
- Aliases
- Totbrick, TSPY_TRICKLOAD
- Version
- 2.2
- Created
- 2018-10-17
Description
TrickBot is a Trojan spyware program written in C++ that first emerged in September 2016 as a possible successor to Dyre. TrickBot was developed and initially used by Wizard Spider for targeting banking sites in North America, Australia, and throughout Europe; it has since been used against all sectors worldwide as part of "big game hunting" ransomware campaigns.
Related
Uses · MITRE ATT&CK (55)
- T1685 Disable or Modify Tools technique
- T1027.013 Encrypted/Encoded File sub-technique
- T1555.005 Password Managers sub-technique
- T1573.001 Symmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1090.002 External Proxy sub-technique
- T1132.001 Standard Encoding sub-technique
- T1571 Non-Standard Port technique
- T1564.003 Hidden Window sub-technique
- T1204.002 Malicious File sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1497.003 Time Based Checks sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1087.001 Local Account sub-technique
- T1087.003 Email Account sub-technique
- T1555.003 Credentials from Web Browsers sub-technique
- T1559.001 Component Object Model sub-technique
- T1021.005 VNC sub-technique
- T1056.004 Credential API Hooking sub-technique
- T1110.004 Credential Stuffing sub-technique
- T1027.002 Software Packing sub-technique
- T1553.002 Code Signing sub-technique
- T1552.001 Credentials In Files sub-technique
- T1552.002 Credentials in Registry sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1543.003 Windows Service sub-technique
- T1055.012 Process Hollowing sub-technique
- T1542.003 Bootkit sub-technique
References
- https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/tspy_trickload.n Trend Micro Totbrick Oct 2016
- https://securityintelligence.com/tricks-of-the-trade-a-deeper-look-into-trickbots-machinations/ IBM TrickBot Nov 2016
- https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-adds-remote-application-credential-grabbing-capabilities-to-its-repertoire/ TrendMicro Trickbot Feb 2019
- https://www.crowdstrike.com/blog/wizard-spider-adversary-update/ CrowdStrike Wizard Spider October 2020
- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Totbrick Microsoft Totbrick Oct 2017
- https://www.fidelissecurity.com/threatgeek/2016/10/trickbot-we-missed-you-dyre Fidelis TrickBot Oct 2016
- https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf S2 Grupo TrickBot June 2017