Rewterz Threat Alert – TrickBot Trojan Ready to Steal OpenSSH and OpenVPN Keys

Severity

High

Analysis Summary

The Trickbot banking trojan keeps evolving according to researchers who spotted this week an updated password grabber module that could be used to steal OpenSSH private keys and OpenVPN passwords and configuration files.

TrickBot (also known as Trickster, TrickLoader, and TheTrick) is a modular and constantly updated malware continuously upgraded with new capabilities and modules since October 2016 when it was initially spotted in the wild.

Trickbot just-updated password grabbing module that now targets the OpenSSH and OpenVPN applications was discovered by researchers on a compromised 64-bit Windows 7 device.

The pwgrab64 password grabber module they found is not a new addition, as it was spotted by researchers back in November 2018 while analyzing a variant capable of looting passwords from several web browsers and apps like Google Chrome, Mozilla Firefox, Internet Explorer, Microsoft Edge, Microsoft Outlook, Filezilla, and WinSCP.

In February, this password stealer module got upgraded to grab credentials utilized to authenticate to remote servers using VNC, PuTTY, and Remote Desktop Protocol (RDP).

TrickBot also got updated with Windows Defender circumventing capabilities, was upgraded with a new IcedID proxy module for stealing banking info, and its creators introduced a new module for stealing browser cookies during July.

Impact

Credential theft

Indicators of Compromise

URL

• https[:]//185[.]222[.]202[.]183[:]447/
• https[:]//51[.]89[.]115[.]113[:]447/
• https[:]//81[.]177[.]180[.]252[:]447/
• https[:]//5[.]182[.]211[.]61[:]447/
• https[:]//185[.]99[.]2[.]245[:]447/
• https[:]//5[.]2[.]76[.]193[:]447/
• https[:]//91[.]92[.]136[.]82[:]447/
• https[:]//185[.]203[.]243[.]138[:]447/
• https[:]//146[.]185[.]253[.]170[:]447/
• https[:]//212[.]73[.]150[.]233[:]443/

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent by unknown senders.
• Never click on the links/attachments sent by unknown senders.