(Aaron) Hey, I'm Aaron Rosenmund, and I'm here with Tyler Hudak.
Thanks for joining us in this Play by Play for Malware Analysis and Detection.
We're going to be focusing on TrickBot this time,
and we're going to go through what TrickBot is,
why it's new and prolific, maybe not necessarily new,
but kind of new again, a resurgence of TrickBot and how it works.
We're going to do some dynamic analysis of it.
We're going to extract some IOCs from that and talk about how we
can do different types of detections as well.
So, we can get right into that.
Tyler, what is TrickBot?
(Tyler) TrickBot is a Trojan, it's a piece of malware.
It's actually been around for a couple years,
since at least 2016, maybe a little bit longer than that.
And TrickBot was originally used as a banking Trojan.
Basically, just to steal financial information.
It would get on people's systems, it would steal their banking credentials,
it would insert little pieces of code into the web browser
when they would travel to their website,
to the banking websites, and since then though,
it's kind of progressed and it's gotten a lot of capabilities,
and so, especially recently, within like the last year or so,
we've seen TrickBot grow from just being a banking Trojan
to kind of being a means to an end.
A lot of times you will see it get into a network,
it'll just spread throughout the entire network,
getting as much information as it can,
and then kind of when the people behind TrickBot,
or whoever's running it, decide that they've got enough information,
then they kind of move to their next phase,
which is usually deploying ransomware in the environment.
(Aaron) Right, so it's more of the triple threat that we talked about.
(Tyler) Exactly.
The big thing to remember is if you see TrickBot on your
network or if you find it on your network,
that is not something that you want to ignore,
it's eventually going to lead to something else.
Now, in some incidents that I've worked,