Trojan.TrickBot

Short bio

Trojan.TrickBot is Malwarebytes’ detection name for a trojan that comes in modules with a configuration file. For a full analysies please read TrickBot comes with new tricks – attacking Outlook and browsing data.

Symptoms

In some variants of Trojan.TrickBot users may be confronted with a screenlocker, but not for all of them as this tojan is still under development.

Type and source of infection

Trojan.TrickBot focuses on stealing banking information.
Trojan.TrickBot uses several methods of propagation including phishing campaigns and the Microsoft Windows vulnerability EternalBlue.

Protection

Malwarebytes protects users from Trojan.TrickBot by using real-time protection.

block Trojan.TrickBot

Malwarebytes blocks Trojan.TrickBot

Remediation

Malwarebytes can detect and remove Trojan.Trickbot without further user interaction.

  1. Please download Malwarebytes to your desktop.
  2. Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
  3. Then click Finish.
  4. Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
  5. If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
  6. When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  7. Restart your computer when prompted to do so.

Traces/IOCs

Trojan Trick bot typically creates a folder under %APPDATA%\Roaming to park its modules:

Examples:

%APPDATA%\Roaming\winapp\Modules

%APPDATA%\Roaming\TeamViewer\Modules

Cybersecurity info you can’t do without

Want to stay informed on the latest news in cybersecurity? Sign up for our newsletter and learn how to protect your computer from threats.

Select your language