Hackers Use TrickGate Packer to Deploy Emotet, Cobalt Strike & Other Malware

The cybersecurity analysts at Check Point Research recently reported that TrickGate, a shellcode-based packer, has been in operation for over six years without being detected. It has enabled threat actors to deploy various types of malware such as:- 

• TrickBot
• Emotet
• Cobalt Strike
• AZORult
• Agent Tesla
• FormBook
• Cerber
• Maze
• REvil

TrickGate is a transformative packer that has managed to evade detection for several years. This is because it periodically undergoes changes, which allows it to remain hidden from security measures.

Since late 2016 TrickGate has been available as a service to other threat actors, behind a layer of wrapper code it’s furnishing a means of disguising payloads. 

This is done in an effort to bypass security solutions installed on the target host, making it easier for malicious actors to execute their attacks undetected.

Packers can serve a dual purpose as cryptos by encrypting malware in order to obfuscate it. This mechanism makes it more difficult for security solutions to detect and analyze the malicious code, allowing the attacker to operate with a lower risk of being discovered.

Packers are designed to evade detection by security solutions, and they do this through a variety of features. Some packers can appear as benign files, making it difficult for security tools to identify them as malicious. 

Others are designed to be difficult to reverse engineer, making it harder for analysts to understand the behavior of the malware they are designed to hide. 

Additionally, some packers incorporate sandbox evasion techniques, allowing them to avoid detection by security systems that use sandboxes to execute and analyze code. 

TrickGate Packer Used to Deploy Malware

Over the last two years, security experts have reported monitoring between 40 to 650 attacks per week. However, the frequent updates to TrickGate as a commercial packer-as-a-service have resulted in it being tracked under different names since 2019 and here below we have mentioned those names:-

• New loader
• Loncom
• NSIS-based crypter

While the complete attack flow involves the following things:-

• Initial Access
• Initial Files
• Shellcode Loader
• Shellcode
• Payload

Check Point’s telemetry data suggests that the threat actors utilizing TrickGate have primarily targeted the manufacturing sector, with education, healthcare, government, and finance also being impacted to a lesser extent.

Popular Malware Families Used

In the past two months, the most commonly observed malware families used in attacks include:-

• FormBook
• LokiBot
• Agent Tesla
• Remcos
• Nanocore

While the significant concentrations of these malware families are in the following countries:-

• Taiwan
• Turkey
• Germany
• Russia
• China

The process of spreading an infection involves the use of phishing emails that contain harmful attachments or links. These links, when clicked, result in the download of a shellcode loader. The role of this loader is to decrypt and activate the actual payload, causing it to be launched into the memory.

Network Security Checklist – Download Free E-Book