November 19, 2018

TrickBot Banking Trojan Starts Stealing Windows Problem History



Recently a new version of TrickBot found of stealing Windows system reliability and performance information that is slightly out of the box as compare to normal scope of any banking Trojans.
Windows runs a reliability Analysis Matrix(RAC) to process the reliability monitoring on new installation of any software, upgrade or any kind of system error from the Operating system and applications well as hardware related problems.


For this, windows runs its RACAgent scheduled task hourly basis and store the date to a local folder. We can also disable the these details from task scheduler, but doing that you will no longer get the Reliability Monitor’s System Stability index.\


A detailed reports from a phishing campaign from My Online Security disclose that a TrickBot spotted focused on collecting and reading the Windows reliability database and information available under the C:\ProgramData\Microsoft\RAC\




Security Researcher published a list of files collected by the malware in twitter:
However it is still unclear purpose of collecting these data, but there must be a malicious purposes, like targeting phishing emails.


The phishing campaign sends TrickBot with emails claiming from Lloyds Bank using the email id donotreply@lloydsbankdocs.com which makes people believe the purpose of the email genuine.
The attacker crafts the email such a way that the reader will read the mail with full believe and open the attached document with malicious Macro. The Macro code then executes and enabled the TrickBot inside the system.



  

The Word document attached to the email has the Lloyds Bank letterhead to make it feel genuine. Added more with Symantec logo under the cover letter saying the file passes with the security solution.




After all the efforts to hide the malicious purpose, the file detected by 30 antivirus engines on Virus Total.

10 comments:

  1. Yes, I am entirely agreed with this article, and I just want say that this article is very helpful and enlightening. I also have some precious piece of concerned info !!!!!!Thanks statelife insurance - hbl platinum card

    ReplyDelete
  2. Multi channel offerings like machine based (ATMs and pc-Banking), card based (credit/Debit/Smart cards), Communication based (Tele-Banking and Internet Banking) ushered in Anytime and Anywhere Banking by the banks in India.Best banks in India

    ReplyDelete
  3. This comment has been removed by the author.

    ReplyDelete
  4. The central bank provided most of the commercial banking needs of enterprises in addition to other functions. During the late 1980s, the CEECs modified this earlier structure by taking all the commercial banking activities of the central bank and transferring them to new commercial banks.https://myifsccode.com/

    ReplyDelete
  5. Fantastic blog you have here. You’ll discover me looking at your stuff often. Saved! 10 free instagram likes instantly

    ReplyDelete
  6. Regardless of why you watched this form of mortgage is probably proper for you, it is essential to recognize the running capital ratio that will help you decide how plenty cash you have to request. Working Capital

    ReplyDelete
  7. 1 UBS AG Switzerland 2 Barclays UK 3 The Royal Bank of Scotland Group UK 4 Deutsche Bank AG Germany 5 BNP Paribas SA France 6 The Bank of Tokyo-Mitsubishi UFJ Ltd Japan 7 ABN AMRO Holding NV Netherlands 8 Societe Generale France 9 Credit Agricole SA France 10 Bank of America NA USA Bookkeeping Services

    ReplyDelete
  8. I’m very happy to read this. This is the type of manual that needs to be given and not the accidental misinformation that’s at the other blogs. Appreciate your sharing this greatest doc. Slice invitation code

    ReplyDelete
  9. Whatever you are a seller or a buyer you can use their processor to process your payments. How to be a Payment Processing Company

    ReplyDelete
  10. I haven’t any word to appreciate this post.....Really i am impressed from this post....the person who create this post it was a great human..thanks for shared this with us. Selling Merchant Services

    ReplyDelete