A phishing campaign using Google Docs links to evade email gateway detection and distribute TrickBot. The emails are sent via the legitimate Google Docs services, which means the content is a legitimate shared file notification from Google and contains only Google links. The message from the sender claims to be regarding a previously sent document that needs to be viewed. If a user falls for the lure, they are directed to a Google Docs file hosted on the genuine Google service. The content of the document is a fake 404 error and a link to an executable hosted on Google Drive. The file masquerades as a PDF in order to trick a user into opening it. If it is opened, it first creates a copy of itself in the ProgramData folder and an additional copy in a subfolder of the User AppData directory, which also contains the TrickBot configuration. Persistence is established via a scheduled task that executes the payload every 11 minutes. Finally, it hollows out svchost.exe to inject the malicious code. Additional svchost processes are continually spawned to run various TrickBot modules.
IP(s) / Hostname(s)
Malware Hash (MD5/SHA1/SH256)