(Aaron) I see.
(Tyler) So we want to go in and we want to decode all this, right?
We want to see, especially the configuration files,
if we were to decode the plugins, we're just going to see executables.
We can still go in and then do reverse engineering on those executables.
But, they're going to have all of the protections that the initial stage,
like you saw when you were throwing it into IDA Pro and all
that to try to do reverse engineering.
We're more interested, at this point, with the configuration files.
(Aaron) Right.
Fastest path to get some usable information.
(Tyler) Right, it's going to give us indicators.
Now, you can see here, at least with this one,
remember, this is the injectDll64 plugin,
which is to grab banking activity.
And we've got three configuration files in here.
But you know, let's just try to open it up really fast.
I'm going to open it up in Notepad++.
(Aaron) Oh, great.
(Tyler) It's all binary data.
It's encrypted.
So we need to figure out how are we going to decrypt this.
Fortunately, there are some great tools available that will allow us to do that.
(Aaron) Okay.
(Tyler) The tools come from a researcher,
a malware researcher, named hasherezade.
She is amazing.
If you go out to her GitHub,
she's got tons of tools that she's created for malware analysis,
especially for TrickBot.
And so, we're going to use her tools in order to decode the files here.
So, I've got two tools that we're going to use from her.
One is called make_bot_key, which is an executable.
You can actually go and download the source code for this
or the compiled version from her GitHub.
And then a Python script called trick_config_decoder.
Now, the first thing we need to do is get the bot key,
and this is the key that's used to encrypt all the files.
There are ways that we can kind of use the settings,
that INI file that TrickBot drops, to get some of the key out,
but then we kind of have to brute force the rest,
and that could take a while.
If we run this program, it's just going to give us the key.
(Aaron) Is this leveraging information that's dropped by TrickBot,
or is this just doing the same thing that TrickBot did to make the key?
(Tyler) A little of both.
What it does is,
hasherezade has gone through and done a lot of reverse engineering on TrickBot,
and so she knows what it needs in order to make the key.
So I'm going to run this.
Just going to do make_bot_key,
and you can see here it says the bot key is this really long string.
So I'm just going to copy this out.
So throw it in Notepad because we're going to use this later.
So that is our bot key.
What I'm going to do here is we're going to try and decode these.
And so I'm going to go into this directory,
if we're looking here we have the three files.
I'm going to run the Python script.
I've already installed Python on my system,
so obviously if you're going to run these you would have to
do it on a system that has Python on it.
And just to show we're not doing any tricks here,
let me run the make_bot_key again and you can see it
does come up with the same key.
So it's not necessarily dependent on where you're running it from the system,
which is good to know.
There are some tools that you need to be in a certain directory,
something like that.
(Aaron) Got it.
And it's not time-dependent either?
(Tyler) Correct.
(Aaron) Great.
(Tyler) So what I'm going to do here, get rid of this,
I'm going to run Python tools\hasherezade,
and then our code name, trick_config_decoder.
Now, it does need a number of options.
We need to give it the bot key, the data file that we're decoding,
and then we're going to need to tell it where to put that.
So we're going to run that now.
(Aaron) Does this work on any of the module's configs?
(Tyler) So far, yes.
Now,
this doesn't mean that TrickBot can't change
tomorrow and modify what it's doing,
but it will work on any of the files that are on here.
So what I'm going to do is I'm going to give it the data file.
We're going to start with the first one, the dinj one.
I'll give it the botkey.
We can copy/paste that into here.
If you don't give it an outfile it will just throw it onto the screen.
I want to have it put somewhere.
So I'm going to do outfile, and we'll call this dinj_out.txt.
(Aaron) Great.
(Tyler) And hopefully it worked.
Any time it decodes something,
the script will extract the module to a DLL file
and dump the decoded text there.
The only time we're really concerned about the DLL file is
if we're decoding one of the plugins.
You still get some data outside of it if you're doing the configuration files,
but you can ignore that.
(Aaron) I see.
So it's decoding the executable, as well as the config file?
(Tyler) Exactly.
Normally, yes,
but in this case we're just telling it to do the configuration file.
So I'm going to, let me do it to the other two.
So I want to do it to dpost.
That's another configuration file.
And again,
I'm going to keep the same bot key and I'm going to change the outfile.
All right, great.
And one last one, the sinj file.
(Aaron) Perfect.
(Tyler) So again,
these are the configuration files for the injects into the banking activity.
So in other words,
we're going to see some of the configuration for the bank stealing activity.
The thing to note, too,
is that each of these plugins can have different configuration files,
and they often do,
and that means that they can often be going to
different command and control IP addresses.
So just because you figured out where one module is going to on the
internet doesn't mean that anybody else is going to that.
(Aaron) And they're different purposes, right?
I'm assuming there's certain targeted sites for the browser injection
that it's going to focus on whereas that isn't necessarily something
that's going to be on the password grabber module.
(Tyler) Right.
So now we have our three outputs.
So I'm going to, let's do sinj first because it's kind of small.
So I'm going to open that up in Notepad++.
The first one, the sinj, it didn't decode properly or it did decode properly,
but here I'm opening up dpost and you can already see that there's a bunch of
command and control IP addresses in there that were decoded.
(Tyler) Let's even open up the original one and you can see it went from this,
with all this binary data, encrypted data,
to this.
And now, we can use this information to look for this activity on our network.
We can search for anybody going to these IP addresses,
we can do information lookups on these IP addresses.
You can see that some of the ports are port 8082.
So that's kind of an unusual port that we could look for.
(Aaron) That's interesting, too.
So some of it is correctly on 443, some of it's on 80 like it normally would be,
but this is attacker infrastructure, right?
And one thing we do know about attacker infrastructure is that changes.
It has to because it's going to be blacklisted, etc.
So is this something that gets updated often?
(Tyler) Yes, in fact, what will happen is,
every once in a while, the attacker,
the TrickBot will go out and will download new configuration files.
Notice, too, something about the lines that specify port 443.
Notice that they're http:\\, not https:\\.
So that could mean that they are, in fact, unencrypted data going over port 443.
So, this is a quick way that an attacker could trick an analyst.
If they're not looking into the data, and they just see oh,
it's 443, which is normally SSL traffic,
they would think that oh, it's encrypted,
I don't need to look at it.
When, in fact, it's not necessarily.
(Aaron) Interesting.
(Tyler) So let's look at the last one.
Hopefully this decoded some information as well.
(Aaron) It's earning its name TrickBot.
(Tyler) There we go, cool.
This is the really big one.
These are all of the different injects that this
module will do into the browser.
So we can see the first line here, not the first line, the first section here.
We have it where it's going to,
if it sees anything going to netteller.com /login2008/Authentication,
it's going to grab that data and it's going to send it to that IP address there.
(Aaron) Got it, okay.
So that's for each different handler and where it's
going to send to using that PHP method.
(Tyler) Exactly.
And this file is 142k.
So we can start going down here and you can just start seeing all of
the different sites and banks and everything that it tries to go to
and that it's going to steal data from.
And, more importantly, where it's going to send it to.
It's going to send it to this IP address.
At least the ones we've seen so far are, you know, 107.174 and so on.
(Aaron) It's also interesting that it's hard coded IP.
So that's another tell.
(Tyler) Right, but remember, you know,
it can very easily go and update a new configuration file and download it,
and all these could change within minutes.
(Aaron) Certainly, which is why