cyber_threat_intelligence/actors/TrickBot/README.md

TrickBot - Cyber Threat Intelligence

These indicators were reported, collected, and generated during the VulDB CTI analysis of the actor known as TrickBot. The activity monitoring correlates data from social media, forums, chat rooms, and darknet markets. It helps to determine associated actors, specific activities, expected intentions, emerging research, and ongoing attacks. Our unique predictive model uses big data to forecast activities and their characteristics.

Live data and more analysis capabilities are available at https://vuldb.com/?actor.trickbot

Campaigns

The following campaigns are known and can be associated with TrickBot:

• AnchorMail

Countries

These countries are directly (e.g. origin of attacks) or indirectly (e.g. access by proxy) associated with TrickBot:

• VN
• RU
• GB
• ...

There are 3 more country items available. Please use our online service to access the data.

IOC - Indicator of Compromise

These indicators of compromise (IOC) indicate associated network resources which are known to be part of research and attack activities of TrickBot.

ID	IP address	Hostname	Campaign	Confidence
1	3.224.145.145	ec2-3-224-145-145.compute-1.amazonaws.com	-	Medium
2	5.1.81.68	mx4.tarifvergleichbhv.net	-	High
3	5.2.75.93	-	-	High
4	5.2.75.167	coms.a9v34.com.cn	-	High
5	5.39.47.22	mail.dmgs.site	-	High
6	5.53.124.49	dgbtechnologies.com	-	High
7	5.59.205.32	dhcp-32-205-59-5.metro86.ru	-	High
8	5.133.179.108	5-133-179-108.freeucouponsnow.ru	-	High
9	5.182.210.30	realestatepromotion.ru	-	High
10	5.182.210.132	-	-	High
11	5.182.210.178	mail.rainingdreams.to	-	High
12	5.182.210.226	-	-	High
13	5.182.210.230	-	-	High
14	5.182.210.246	-	-	High
15	5.182.210.254	n01-nlam.kdktech.com	-	High
16	5.196.247.14	ip14.ip-5-196-247.eu	-	High
17	14.241.244.60	-	-	High
18	18.233.90.151	ec2-18-233-90-151.compute-1.amazonaws.com	-	Medium
19	23.3.13.88	a23-3-13-88.deploy.static.akamaitechnologies.com	-	High
20	23.3.13.154	a23-3-13-154.deploy.static.akamaitechnologies.com	-	High
21	23.3.125.111	a23-3-125-111.deploy.static.akamaitechnologies.com	-	High
22	23.21.27.29	ec2-23-21-27-29.compute-1.amazonaws.com	-	Medium
23	23.21.48.44	ec2-23-21-48-44.compute-1.amazonaws.com	-	Medium
24	23.21.121.219	ec2-23-21-121-219.compute-1.amazonaws.com	-	Medium
25	23.21.252.4	ec2-23-21-252-4.compute-1.amazonaws.com	-	Medium
26	23.23.83.153	ec2-23-23-83-153.compute-1.amazonaws.com	-	Medium
27	23.23.243.154	ec2-23-23-243-154.compute-1.amazonaws.com	-	Medium
28	23.94.233.210	23-94-233-210-host.colocrossing.com	-	High
29	23.96.30.229	-	-	High
30	23.160.192.125	unknown.ip-xfer.net	-	High
31	23.160.193.106	unknown.ip-xfer.net	-	High
32	23.202.231.166	a23-202-231-166.deploy.static.akamaitechnologies.com	-	High
33	23.217.138.107	a23-217-138-107.deploy.static.akamaitechnologies.com	-	High
34	24.162.214.166	cpe-24-162-214-166.elp.res.rr.com	-	High
35	27.72.107.215	dynamic-adsl.viettel.vn	-	High
36	31.131.26.122	-	-	High
37	31.134.60.181	31-134-60-181.telico.pl	-	High
38	31.134.124.90	-	-	High
39	31.172.177.90	poczta.mp-lift.pl	-	High
40	31.184.253.6	-	-	High
41	31.211.85.110	-	-	High
42	34.117.59.81	81.59.117.34.bc.googleusercontent.com	-	Medium
43	34.196.181.158	ec2-34-196-181-158.compute-1.amazonaws.com	-	Medium
44	34.233.102.38	ec2-34-233-102-38.compute-1.amazonaws.com	-	Medium
45	36.37.176.6	-	-	High
46	36.89.191.119	-	-	High
47	36.89.193.181	-	-	High
48	36.89.193.235	-	-	High
49	36.89.228.201	-	-	High
50	36.91.45.10	-	-	High
51	36.91.88.164	-	-	High
52	36.91.117.231	-	-	High
53	36.91.186.235	-	-	High
54	36.94.27.124	-	-	High
55	36.94.100.202	-	-	High
56	36.95.23.89	-	-	High
57	36.95.27.243	-	-	High
58	37.228.70.134	-	-	High
59	37.228.117.250	janome.ru	-	High
60	37.230.112.146	audiotop.ru	-	High
61	37.230.114.93	admin1.fvds.ru	-	High
62	37.230.114.248	kosmolot.com	-	High
63	37.230.115.129	dvcarry.fvds.ru	-	High
64	37.230.115.133	wdai.io	-	High
65	37.230.115.138	i2.com	-	High
66	37.230.115.171	geobrox.com	-	High
67	37.230.115.184	21922vdscom.com	-	High
68	38.132.99.174	-	-	High
69	41.77.134.250	cliente6386477933.clubnet.mz	-	High
70	41.243.29.182	182-29-243-41.r.airtel.cd	-	High
71	43.245.216.116	-	-	High
72	45.5.152.39	-	-	High
73	45.6.16.68	-	-	High
74	45.14.226.115	-	-	High
75	45.36.99.184	cpe-45-36-99-184.triad.res.rr.com	-	High
76	45.115.172.105	-	-	High
77	45.155.173.242	-	-	High
78	45.167.249.126	-	-	High
79	45.178.142.14	-	-	High
80	45.201.134.202	-	-	High
81	45.229.71.211	static-45-229-71-211.extrememt.com.br	-	High
82	45.234.248.154	45.-234.248-154.rev.voanet.br	-	High
83	46.4.167.250	ip-subnet46-4-167.unassigned.theideahosting.net	-	High
84	46.8.21.10	53980.web.hosting-russia.ru	-	High
85	46.8.21.113	64403.web.hosting-russia.ru	-	High
86	46.30.45.208	vm418209.eurodir.ru	-	High
87	46.99.175.217	-	-	High
88	46.209.140.220	-	-	High
89	46.254.128.174	46.254.128.174.lanultra.net	-	High
90	49.156.34.134	-	-	High
91	50.16.229.140	ec2-50-16-229-140.compute-1.amazonaws.com	-	Medium
92	50.19.247.198	ec2-50-19-247-198.compute-1.amazonaws.com	-	Medium
93	51.38.101.194	-	-	High
94	51.77.92.215	-	-	High
95	51.81.112.144	-	-	High
96	51.89.115.101	secure-3111.buzztary.com	-	High
97	51.89.115.108	coms.jt120.com.cn	-	High
98	51.89.115.112	brides-crude.nationfox.net	-	High
99	51.89.115.116	tombe.nationfox.net	-	High
100	51.89.115.121	mail1.cmailer.online	-	High
101	51.159.23.217	jambold.co.uk	-	High
102	51.254.83.17	ip17.ip-51-254-83.eu	-	High
103	51.254.164.243	amortizserv.info	-	High
104	51.254.164.245	ip245.ip-51-254-164.eu	-	High
105	52.0.197.231	ec2-52-0-197-231.compute-1.amazonaws.com	-	Medium
106	52.20.197.7	ec2-52-20-197-7.compute-1.amazonaws.com	-	Medium
107	52.202.139.131	ec2-52-202-139-131.compute-1.amazonaws.com	-	Medium
108	52.204.109.97	ec2-52-204-109-97.compute-1.amazonaws.com	-	Medium
109	52.206.161.133	ec2-52-206-161-133.compute-1.amazonaws.com	-	Medium
110	54.39.106.25	ns560342.ip-54-39-106.net	-	High
111	54.204.36.156	ec2-54-204-36-156.compute-1.amazonaws.com	-	Medium
112	54.221.253.252	ec2-54-221-253-252.compute-1.amazonaws.com	-	Medium
113	54.235.124.112	ec2-54-235-124-112.compute-1.amazonaws.com	-	Medium
114	54.243.147.226	ec2-54-243-147-226.compute-1.amazonaws.com	-	Medium
115	54.243.198.12	ec2-54-243-198-12.compute-1.amazonaws.com	-	Medium
116	58.97.72.83	58-97-72-83.static.asianet.co.th	-	High
117	60.51.47.65	-	-	High
118	62.64.9.237	clients-62.64.9.237.misp.ru	-	High
119	62.69.241.103	62-69-241-103.internetia.net.pl	-	High
120	62.99.76.213	213.62-99-76.static.clientes.euskaltel.es	-	High
121	62.109.2.172	megamart24.ru	-	High
122	62.109.6.188	velomarket31.ru	-	High
123	62.109.14.24	btc-manager1.ru	-	High
124	...	...	...	...

There are 493 more IOC items available. Please use our online service to access the data.

TTP - Tactics, Techniques, Procedures

Tactics, techniques, and procedures (TTP) summarize the suspected MITRE ATT&CK techniques used by TrickBot. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Weakness	Description	Confidence
1	T1040	CWE-294	Authentication Bypass by Capture-replay	High
2	T1059.007	CWE-79	Cross Site Scripting	High
3	T1068	CWE-250, CWE-264, CWE-274, CWE-284	Execution with Unnecessary Privileges	High
4	...	...	...	...

There are 8 more TTP items available. Please use our online service to access the data.

IOA - Indicator of Attack

These indicators of attack (IOA) list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration by TrickBot. This data is unique as it uses our predictive model for actor profiling.

ID	Type	Indicator	Confidence
1	File	/admin.php?id=posts&action=display&value=1&postid=	High
2	File	/admin.php?id=siteoptions&social=display&value=0&sid=2	High
3	File	/admin.php?id=siteoptions&social=edit&sid=2	High
4	File	/admin/goods/update	High
5	File	/admin/inbox.php&action=delete	High
6	File	/admin/inbox.php&action=read	High
7	File	/admin/pagerole.php&action=display&value=1	High
8	File	/admin/pagerole.php&action=edit	High
9	File	/admin/posts.php	High
10	File	/admin/posts.php&action=delete	High
11	File	/admin/posts.php&action=edit	High
12	File	/admin/siteoptions.php&action=displaygoal&value=1&roleid=1	High
13	File	/admin/siteoptions.php&social=remove&sid=2	High
14	File	/admin/uesrs.php&&action=delete&userid=4	High
15	File	/admin/uesrs.php&action=display&value=Hide	High
16	File	/admin/uesrs.php&action=display&value=Show	High
17	File	/admin/uesrs.php&action=type&userrole=Admin&userid=3	High
18	File	/admin/uesrs.php&action=type&userrole=User	High
19	File	/api/students/me/messages/	High
20	File	/apply.cgi	Medium
21	File	/apps/acs-commons/content/page-compare.html	High
22	File	/blog/blog.php	High
23	File	/Car_Rental/booking.php	High
24	...	...	...

There are 197 more IOA items available (file, library, argument, input value, pattern, network port). Please use our online service to access the data.

References

The following list contains external sources which discuss the actor and the associated activities:

• https://blog.talosintelligence.com/2018/01/threat-round-up-1229-0105.html
• https://blog.talosintelligence.com/2018/07/smoking-guns-smoke-loader-learned-new.html
• https://blog.talosintelligence.com/2019/07/threat-roundup-0628-0705.html
• https://blog.talosintelligence.com/2019/07/threat-roundup-0719-0726.html
• https://blog.talosintelligence.com/2019/07/threat-roundup-for-0705-0712.html
• https://blog.talosintelligence.com/2019/08/threat-roundup-0809-0816.html
• https://blog.talosintelligence.com/2019/08/threat-roundup-0823-0830.html
• https://blog.talosintelligence.com/2021/02/threat-roundup-0212-0219.html
• https://blog.talosintelligence.com/2021/03/threat-roundup-0319-0326.html
• https://blog.talosintelligence.com/2021/04/threat-roundup-0326-0402.html
• https://blog.talosintelligence.com/2021/04/threat-roundup-0409-0416.html
• https://blog.talosintelligence.com/2021/04/threat-roundup-0416-0423.html
• https://blog.talosintelligence.com/2021/05/threat-roundup-0514-0521.html
• https://blog.talosintelligence.com/2021/07/threat-roundup-0625-0702.html
• https://blog.talosintelligence.com/2021/08/threat-roundup-0730-0806.html
• https://blog.talosintelligence.com/2021/10/threat-roundup-0924-1001.html
• https://blog.talosintelligence.com/2021/10/threat-roundup-1015-1022.html
• https://blog.talosintelligence.com/2021/11/threat-roundup-1029-1105.html
• https://blog.talosintelligence.com/2021/11/threat-roundup-1105-1112.html
• https://blogs.blackberry.com/en/2019/09/blackberry-cylance-vs-trickbot-infostealer-malware
• https://feodotracker.abuse.ch/downloads/ipblocklist.csv
• https://isc.sans.edu/forums/diary/Emotet+epoch+1+infection+with+Trickbot+gtag+mor84/25752/
• https://isc.sans.edu/forums/diary/Emotet+malspam+is+back/25330/
• https://isc.sans.edu/forums/diary/German+language+malspam+pushes+yet+another+wave+of+Trickbot/25594/
• https://isc.sans.edu/forums/diary/Malspam+pushing+Trickbot+banking+Trojan/22720/
• https://isc.sans.edu/forums/diary/Malspam+pushing+Trickbot+gtag+rob13/27112/
• https://isc.sans.edu/forums/diary/Malspam+pushing+Trickbot+malware+on+Friday+20180511/23653/
• https://isc.sans.edu/forums/diary/Malspam+with+passwordprotected+word+docs+still+pushing+IcedID+Bokbot+with+Trickbot/24708/
• https://isc.sans.edu/forums/diary/One+Emotet+infection+leads+to+three+followup+malware+infections/24140/
• https://isc.sans.edu/forums/diary/Trickbot+gtag+red5+distributed+as+a+DLL+file/25918/
• https://research.checkpoint.com/2021/when-old-friends-meet-again-why-emotet-chose-trickbot-for-rebirth/
• https://securelist.com/trickbot-module-descriptions/104603/
• https://securityintelligence.com/posts/new-malware-trickbot-anchordns-backdoor-upgrades-anchormail/
• https://thedfirreport.com/2020/04/30/tricky-pyxie/
• https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/
• https://thedfirreport.com/2021/05/02/trickbot-brief-creds-and-beacons/
• https://thedfirreport.com/2021/08/01/bazarcall-to-conti-ransomware-via-trickbot-and-cobalt-strike/
• https://thedfirreport.com/2021/08/16/trickbot-leads-up-to-fake-1password-installation/

Literature

The following articles explain our unique predictive cyber threat intelligence:

• VulDB Cyber Threat Intelligence Documentation
• Cyber Threat Intelligence - Early Anticipation of Attacks

License

(c) 1997-2022 by vuldb.com. All data on this page is shared under the license CC BY-NC-SA 4.0. Questions? Check the FAQ, read the documentation or contact us!