Trickbot Updates Password Grabber Module
Summary: Unit 42 reported in November 2019 that Trickbot's password grabber module, pwgrab64, began sending new HTTP POST requests targeting OpenSSH private keys and OpenVPN passwords and configurations, with identifiers including 'configsls,' a possible misspelling of 'configs.' The researchers said the new OpenSSH and OpenVPN requests fired whether or not those applications were installed and carried no actual data in lab infections on Windows 7 and Windows 10, while the module did successfully capture SSH passwords and private keys from PuTTY.
Bottom line: Trickbot's password grabber sends stolen data over unencrypted HTTP on TCP port 8082, and it already pulls private keys from PuTTY - so an SSH key that grants access to a cloud server can leave a Windows host in plaintext even while the OpenSSH and OpenVPN targeting remains unfinished.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026