EscInSecurity

null

[EscInSecurity @EscInSecurity]

I've put all my historical #TrickBot analyses into a blog to aid access and info sharing. https://t.co/H9aUOdmzwW

[EscInSecurity @EscInSecurity]

@martijn_grooten @JR0driguezB @hasherezade Oh, and don’t think I’m ignoring you. Switching up projects from weekly tracking to deeper analysis of the last year or so’s worth of data. Plan to publish some of this analysis next year.

[EscInSecurity @EscInSecurity]

@martijn_grooten @JR0driguezB @hasherezade Lol; thing is “config version number centenary” doesn’t roll of the tongue in quite the same way. Anyway, happy config version number centenary #TrickBot, now stop please. There are better things to do than reach 400; go read a good book or take a walk in the countryside.

[EscInSecurity @EscInSecurity]

@JR0driguezB You've been a star with that tracker. Just want to say thanks for all the data you've been providing for the last year!

[EscInSecurity @EscInSecurity]

.@LastlineLabs, would you share IOCs related to the first half of this article please. https://t.co/667dtXe967

[EscInSecurity @EscInSecurity]

@hasherezade @JR0driguezB @0bscureC0de @VK_Intel @K_N1kolenko @ArnaudDlms @StackGazer @voidm4p @James_inthe_box @makflwana @_ddoxer @spalomaresg @virsoz @moutonplacide @JasonMilletary @Ring0x0 @precisionsec @Techhelplistcom @pollo290987 @MalHunters @coldshell My ongoing #TrickBot infrastructure analysis research (https://t.co/9B9n7ArEmr) also uses data shared by @0x7fff9; @kobebryamV2; @dvk01uk; @benkow_; @MalwareSecrets; @SaurabhSha15; @abuse_ch; @HerbieZimmerman; @Artilllerie; @mesa_matt; and @trickbot.

[EscInSecurity @EscInSecurity]

[NEW POST] #TrickBot infrastructure analysis for w/c 24-Sep-18. Covers 2,691 C2 IPs used in 588 mcconfs across 322 versions.

https://t.co/uMr37G28e0

[EscInSecurity @EscInSecurity]

@hasherezade @JR0driguezB @0bscureC0de @VK_Intel @K_N1kolenko @ArnaudDlms @StackGazer @voidm4p @James_inthe_box @makflwana My ongoing #TrickBot infrastructure analysis research (https://t.co/9B9n7ArEmr) also uses data shared by @_ddoxer; @spalomaresg; @virsoz; @moutonplacide; @JasonMilletary; @Ring0x0; @precisionsec; @Techhelplistcom; @pollo290987; @MalHunters; @coldshell ...

[EscInSecurity @EscInSecurity]

Awesome

[GCHQ @GCHQ]

⛪️ | Stuck for something to do over the weekend? Our #Poppyfall is on display @GlosCathedral in support of @PoppyLegion and is open to view from today #ThankYou100

[EscInSecurity @EscInSecurity]

@hexwaxwing @executemalware @malwareunicorn Threat actor trading cards exist; at least I know a UK security consultancy that made a pack.

[EscInSecurity @EscInSecurity]

#TrickBot got some upgrades recently.

[sysopfb @sysopfb]

New trickbot crypter is pretty cool from @malware_traffic, encrypts the layer2 with a private key which will decrypt out the next layer
First layer has backwards dll "23lenreK"
Second layer has custom base64 alphabet to decode strings and some anti checks.

[EscInSecurity @EscInSecurity]

@OsLinux10 Are these unique uploaded sample hashes, or just a count of submissions?

[EscInSecurity @EscInSecurity]

@hasherezade @JR0driguezB @0bscureC0de @VK_Intel @K_N1kolenko @ArnaudDlms @StackGazer @voidm4p @James_inthe_box @makflwana @_ddoxer @spalomaresg @virsoz @moutonplacide @JasonMilletary @Ring0x0 @precisionsec @Techhelplistcom @pollo290987 @MalHunters @coldshell My ongoing #TrickBot infrastructure analysis research (https://t.co/9B9n7ArEmr) also uses data shared by @0x7fff9; @kobebryamV2; @dvk01uk; @benkow_; @MalwareSecrets; @SaurabhSha15; @abuse_ch; @HerbieZimmerman; @Artilllerie; @mesa_matt; and @trickbot.

[EscInSecurity @EscInSecurity]

[NEW POST] #TrickBot infrastructure analysis for w/c 17-Sep-18. Covers 2,667 C2 IPs used in 582 mcconfs across 317 versions.

https://t.co/bs7xGBFhsh

[EscInSecurity @EscInSecurity]

@hasherezade @JR0driguezB @0bscureC0de @VK_Intel @K_N1kolenko @ArnaudDlms @StackGazer @voidm4p @James_inthe_box @makflwana My ongoing #TrickBot infrastructure analysis research (https://t.co/9B9n7ArEmr) also uses data shared by @_ddoxer; @spalomaresg; @virsoz; @moutonplacide; @JasonMilletary; @Ring0x0; @precisionsec; @Techhelplistcom; @pollo290987; @MalHunters; @coldshell ...

[EscInSecurity @EscInSecurity]

@malware_traffic NewBCtestDll64 previously reported as back connect remote cmd shell - timing makes sense if using that to deploy Empire.

[EscInSecurity @EscInSecurity]

Sharing is caring ...

[NCSC UK @NCSC]

Wanna join our gang? Share threat information in real time on CiSP... https://t.co/9y3qw3jt91

[EscInSecurity @EscInSecurity]

@LukasStefanko "should" not "do"

[EscInSecurity @EscInSecurity]

@JR0driguezB Nice ... looks like someone got a little enthusiastic with the backspace key.