Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Wireshark Tutorial: Examining Trickbot Infections

Summary: Unit 42's tutorial walks through Wireshark packet captures of Trickbot, an information stealer and banking malware infecting victims since 2016 and distributed through malspam, Emotet, IcedID, or Ursnif. The captures show a September 2019 malspam infection delivering a zip archive with InvoiceAndStatement.lnk and a Trickbot executable from 144.91.69[.]195, followed by HTTPS command-and-control over TCP ports 443, 447, and 449 with certificate issuer data reading Some-State and Internet Widgits Pty Ltd.

What's compelling: In the Emotet-plus-Trickbot capture, an infected client at 10.9.25.102 used a version of the EternalBlue exploit over TCP port 445 to move to a domain controller at 10.9.25.9, which then pulled a Trickbot executable from 185.98.87[.]185/wredneg2.png - and the same infection sent browser-cached passwords and system data to command-and-control over TCP port 8082.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related