Rewterz Threat Alert – Trickbot Malware Resurfaces with New Version

Severity

High

Analysis Summary

Newer TrickBot Version “1077” (JMP+2) is found actively targeting victims. TrickBot is a Banking Malware long known for its malicious usage in different campaigns targeting multiple industries. Recently, new variants have been released with additional capabilities. Aside from its information theft capabilities, it also deletes files located in removable and network drives that have particular extensions, after which the files are replaced with a copy of the malware.

Impact

• Information theft
• Exposure of sensitive information

Indicators of Compromise

MD5

• d2b88f123ef635c5344fee05b3f3f7fb
• f52e16efce974ebb303e9f51057e57c5

SH256

• a2188ff2dcca659807db8898153c88520d41033b8f446ecb932957abb6237abb
• 282ffa30ab335c816cdbd3a411b32b777efd675fe8e0c53704ac9d7d09648b88

SHA1

• 408a9e287e48ce2030da93ae236e76c6afd188e5
• 9c1fb6fae217b0b908c42eae42605f470a3015ce

Source IP

• 198.46.190[.]14
• 37[.]44 [.]212[.]148
• 185[.]65[.]202[.]127
• 193[.]37[.]212[.]246
• 193[.]124[.]191[.]243
• 31[.]148[.]99[.]63
• 94[.]103[.]91[.]61
• 203[.]23[.]128[.]179
• 179[.]43[.]147[.]72
• 93[.]123[.]73[.]192
• 51[.]89[.]115[.]120
• 144[.]91[.]76[.]214
• 46[.]21[.]153[.]81
• 194[.]5[.]250[.]98
• 190[.]154[.]203[.]218
• 178[.]183[.]150[.]169
• 200[.]116[.]199[.]10
• 181[.]113[.]20[.]186
• 187[.]58[.]56[.]26
• 85[.]11[.]116[.]194
• 81[.]190[.]160[.]139
• 200[.]21[.]51[.]38
• 181[.]49[.]61[.]237
• 46[.]174[.]235[.]36
• 91[.]232[.]52[.]187
• 36[.]89[.]85[.]103
• 31[.]128[.]13[.]45
• 186[.]42[.]185[.]10
• 170[.]233[.]120[.]53
• 89[.]228[.]243[.]148
• 31[.]214[.]138[.]207
• 186[.]42[.]98[.]254
• 195[.]93[.]223[.]100
• 181[.]112[.]52[.]26
• 190[.]13[.]160[.]19
• 186[.]47[.]122[.]182
• 186[.]71[.]150[.]23
• 190[.]152[.]4[.]98
• 170[.]82[.]156[.]53
• 131[.]161[.]253[.]190
• 181[.]113[.]114[.]50
• 186[.]47[.]121[.]58
• 185[.]70[.]182[.]162
• 200[.]127[.]121[.]99
• 45[.]235[.]213[.]126

Remediation

• Block the threat indicators at their respective controls.
• Do not download random files from the internet.
• Closely monitor port 443 and 449.