Posted by Martijn Grooten on Nov 3, 2017
Trickbot, first reported a year ago by Malwarebytes researcher Jérôme Segura as the successor of Dyre/Dyreza, has become perhaps the most important banking trojan of 2017. It is known for its regular updates, with its use of SMB for lateral movement particularly noteworthy.
Symantec's Director of Threat Research Andrew Brandt is one of many security researchers who keeps a close eye on Trickbot. In particular, he has been focusing on its command-and-control communication over TLS-encrypted channels, by using a tool that allows him to perform man-in-the-middle decryption. He presented his findings as a last-minute paper at VB2017.
Andrew Brandt presenting his paper 'Turning Trickbot: decoding an encrypted command-and-control channel' at VB2017, Madrid.
Today, we have uploaded the recording of Andrew's presentation to our YouTube channel. We have also published his slides (pdf), for those who want to study the many technical details of Andrew's talk a bit more carefully.
