Thursday, March 28, 2024

Hackers Launching Trickbot Malware That Steals VNC, PuTTY and RDP Credentials

The new variant of infamous trickbot malware comes with the capability of grabbing remote application login credentials.

Trickbot is a banking malware which steals login credentials from applications, it was discovered long back ago, the threat actors continiously adding new capabilities to the malware.

Security researchers from TrendMicro observed the bew variant that bagged with extensive number of tricks to grab the login credentials.

Trickbot Infection Chain

The infection chains start with an Email appear to be a tax incentive notification from a financial institution. The Email contains an macro enabled Microsoft Excel spreadsheet. For string encryption the trickbot variant uses XOR or SUB routines.


Infection chain for the malware

Once the user open’s malicious spreadsheet the macro runs and downloads the trickbot malware and activate’s on the infected machine.

The 2019 trickbot variant adds the the following three new functions

  • Virtual Network Computing (VNC)
  • PuTTY
  • Remote Desktop Protocol (RDP) platforms

Virtual Network Computing (VNC)

Inorder to grab login credentials, the pwgrab modules uses to search for vnc.lnk located in the following directories, ready TrendMicro blog post.

%APPDATA%\Microsoft\Windows\Recent
%USERPROFILE%\Documents, %USERPROFILE%\Downloads

It exfiltrates the following information from the infected machine and post to the command-and-control (C&C) servers.

  • Target machine’s hostname
  • Port
  • Proxy settings

Stolen Information being exfiltrated to the C&C server.

PUTTY

To grab the putty credentials it queries the Software\SimonTatham\Putty\Sessions to identify the saved sessions and grabs the following information.

  • Hostname and Username
  • The private key for Authentication

RDP

It uses the CredEnumerateA API to look for the saved login credentials and exfiltrates the hostname, username, and password.

Indicators of Compromise (IOCs)

Trickbot (Detected as TrojanSpy.Win32.TRICKBOT.AZ)

  • 374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05

Trickbot (Detected as Trojan.Win32.MERETAM.AD)

  • Fcfb911e57e71174a31eae79433f12c73f72b7e6d088f2f35125cfdf10d2e1af

Also Read:

New Trickbot Malware Steal Password & Other Sensitive Data From Microsoft Outlook,Chrome,Firefox, IE, Edge

Trickbot Malware Re-emerging via MS Word Documents with Powerful Code-Injection Technique

Upgraded TrickBot Malware Attack Point-of-Sale Machines & Services to Steal Credit/Debit card Data

Website

Latest articles

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Beware of Free Android VPN Apps that Turn Your Device into Proxies

Cybersecurity experts have uncovered a cluster of Android VPN applications that covertly transform user...

ZENHAMMER – First Rowhammer Attack Impacting Zen-based AMD Platforms

Despite AMD's growing market share with Zen CPUs, Rowhammer attacks were absent due to...

Airbus to Acquire INFODAS to Strengthen its Cybersecurity Portfolio

Airbus Defence and Space plans to acquire INFODAS, a leading cybersecurity and IT solutions...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles