Behavioral Analysis of Trickbot Banking Trojan with its New Tricks

Trickbot is a banking trojan designed to steal users private information. Trickbot trojan first appeared in late October 2016 and targeted banks in Australia. Later, it has targeted many other countries financial institutions, banks and credit card providers. As of April 2017, there have been attacks on leading banks in the UK, US, Switzerland, Germany, Canada, New Zealand, France, Ireland. However, in late 2017, the use of encryption techniques in Trickbot became very popular. Later on, Trickbot launched some updates into its malware code. Due to these updates, Trickbot has been constantly evolving and gaining new features. In addition, with added new modules, Trickbot is able to spread itself and infect as many computers as possible. Generally, Trickbot spreads itself with spam e-email campains which includes e-mail attachments that are often hidden as a Microsoft Office document with active macros. When the malicious sample is executed, it downloads some other binaries. In November 2018, Trickbot authors developed a new module for stealing credentials from the most known applications, such as FileZilla, Microsoft Outlook, and WinSCP. From the beginning of January 2019, the latest versions have been available through seasonal themed spam emails, as if they are coming from a major financial advisory firm. In this study, we conducted analyses to reveal Trickbot behaviour while its code is injected into Banking official web sites. We performed static and dynamic analyses using different tools to identify TrickBot-associated streams and detect TrickBot infection. As a result of the analysis, we found out that its authors use web injections to banking websites to steal and access login information. In addition, our analysis revealed that Trickbot targets many international banks in many countries via web injections. We also discovered that Trickbot uses different interfaces and files to replicate itself.