New TrickBot banking Trojan variant borrows spreading capabilities from Wannacry

A cyber gang is improving its version of the TrickBot banking Trojan by implementing the self-spreading worm-like capabilities used by WannaCry and NotPetya

Cybercriminals most of all are capitalizing the lesson from the recent WannaCry and NotPetya ransomware massive attacks.

At least one cyber gang is improving its version of the TrickBot banking Trojan by implementing the self-spreading worm-like capabilities that allowed both ransomware to rapidly spread worldwide.

The new version of the TrickBot banking Trojan, dubbed “1000029” (v24), includes the code for the exploitation of the Windows Server Message Block (SMB) vulnerability.

Recently malware experts at Flashpoint have discovered that the TrickBot Banking Trojan has been improved to spread locally across networks by exploiting the Server Message Block (SMB) flaw.

“On July 27, 2017, in coordination with Luciano Martins, Director of Cyber Risk Services at Deloitte, Flashpoint observed a new version – “1000029” – of the formidable “Trickbot” banking Trojan with a new “worm64Dll” module, spread via the email spam vector, impersonating invoices from a large international financial institution.” states the analysis shared by Flashpoint.

The experts noticed that n of TrickBot ‘1000029’ is still a developing phase, for example, the crooks haven’t yet implemented the feature to mass scan on the Internet for vulnerable systems.

The Trojan actually scans domains for lists of vulnerable servers via the NetServerEnum Windows API and enumerate other computers on the network via Lightweight Directory Access Protocol (LDAP).

“The Trickbot gang appears to be testing a worm-like malware propagation module, which appears to spread locally via Server Message Block (SMB), scan domains for lists of servers via NetServerEnum Windows API, and enumerate other computers via Lightweight Directory Access Protocol (LDAP) enumeration. As of this writing, this malware feature does not appear to be fully implemented by the criminal gang as the initial purported SMB exploit has not yet been observed.” continues the analysis.

The researchers also discovered that the new TrickBot variant can also be disguised as ‘setup.exe’ that is delivered through a PowerShell script to spread through interprocess communication and download additional version of TrickBot onto shared drives.

Experts have no doubt, the Trickbot crew will continue in improving the threat.