Rewterz Threat Alert – Trickbot Banking Trojan hits North American Banks

Analysis Summary

Trickbot Banking Trojan has resurfaced and is being distributed through phishing emails, which are largely targeted towards North American recipients, containing a malicious Excel spreadsheet. Unusually, the subject line and content of the body refer to ACH failures due to erroneous hash totals. Macros need to be enabled for the excel spreadsheet to be able to infect the potential victim. If macros are enabled, a PowerShell script is executed to download the payload and begins the infection process which will result in the Trickbot banking Trojan being installed.

Impact

Loss of sensitive information

server-side injections and redirection attacks

Indicators of Compromise

IP(s) / Hostname(s)

• 198[.]49[.]66[.]162
• 199[.]21[.]106[.]189
• 95[.]213[.]236[.]12
• 193[.]187[.]172[.]100
• 85[.]17[.]172[.]227
• 130[.]185[.]250[.]51
• 85[.]17[.]76[.]90
• 95[.]211[.]242[.]194
• URLs
• api[.]ipify[.]org
• ruanova[.]mx
• tdbankmail[.]com
• http://ruanova[.]mx/5pe[.]rsac
• http://api[.]ipify[.]org/
• http://mastersgb[.]com/5pe[.]rsac
• http://185[.]68[.]93[.]30/radiance[.]png
• Email Address
• Sarah[.]Kochan@tdbankmail.com
• Email Subject
• Company ACH file failure
• Malware Hash (MD5/SHA1/SH256)
• 8ef0b271f1c851ca8e23d843983ae065
• c7c71979e360cfdd5615624a9079ceeb849e7320
• 6e9abf58f8aad7ae634a2e13cc7fdd18babe0d62a5fec60ec62e3754851e5873
• f998c1d9460b52fdab8502057ee1873b10e10cb355a420d524a972514284452d
• 46706124d4c65111398296ea85b11c57abffbc903714b9f9f8618b80b49bb0f3
• 479aa1fa9f1a9af29ed010dbe3b080359508be7055488f2af1d4b10850fe4efc
• 52bc216a6de00151f32be2b87412b6e13efa5ba6039731680440d756515d3cb9
• 627a9eb14ecc290fe7fb574200517848e0a992896be68ec459dd263b30c8ca48
• 8d56f6816f24ec95524d6b434fc25f9aad24a27dbb67eab0106bbd7b4160dc75
• 9a529b2b77c5c8128c4427066c28ca844ff8ebbd8c3b2da27b8ea129960f861b
• a515f4f847e8d7b2eb46a855224c8f0e9906435546bb15785b6770f2143bc22a
• af5ee15f47226687816fc4b61956d78b48f62c43480f14df5115d7e751c3d13d
• b401a0c3a64c2e5a61070c2ae158d3fcf8ebbb51b33593323cd54bbe03d3de00
• b8b757c2a3e7ae5bb7d6da9a43877c951fb60dcb606cc925ab0f15cdf43d033b
• bf50566d7631485a0eab73a9d029e87b096916dfbf07df4af2069fc6eb733183
• c8c789296cc8219d27b32c78e595d3ad6ee1467d2f451f627ce96782a9ff0c5f
• cbb5ea4210665c6a3743e2b7c5a29d10af21efddfbab310035c9a14336c71de3
• dff1c7cddd77b1c644c60e6998b3369720c6a54ce015e0044bbbb65d2db556d5
• f9ebf40d1228fa240c64d86037f2080588ed67867610aa159b80a553bc55edd7
• fe0f269a1b248c919c4e36db2d7efd3b9624b46f567edd408c2520ec7ba1c9e4

Remediation

• Block the IOCs at their respective controls.
• Make sure your anti-virus is up-to-date.
• Do not open unexpected emails and do not click on any email attachments unless the sender is a legitimate and trusted source.
• Do not enable the macros or enable edit to see the document.