Trickbot

Overview

TrickBot (often dubbed Trickloader or Totep) is one of the most prolific and dangerous modular trojans and enterprise access vectors in modern cybercrime history. Developed in 2016 by the Russian-speaking cybercrime syndicate known as Wizard Spider (UNC1878 / Gold Blackburn), TrickBot was built as the direct successor to the Dyre banking trojan, maintaining many of its core architectural principles while vastly expanding its modular attack capabilities. TrickBot features a dynamic plug-in architecture, downloading specialized binary modules on demand to carry out specific malicious objectives. These modules include injectDll (man-in-the-browser webinjections against financial portals), pwgrab (stealing credentials from browsers, email clients, and remote desktop caches), networkDll (active Active Directory and network topology reconnaissance), and wormingDll (lateral movement utilizing the EternalBlue SMB exploit, CVE-2017-0144). Over its lifecycle, TrickBot served as the primary beachhead for high-impact ransomware deployments, including Ryuk and Conti. In 2021 and 2023, the U.S. Department of Justice unsealed indictments against key TrickBot software engineers Alla Witte and Vladimir Dunaev, resulting in federal convictions, while the U.S. Treasury (OFAC) and the UK National Crime Agency (NCA) levied joint financial sanctions against 11 core members.

Known aliases

Threat reports may refer to this family under multiple names:

• TrickBot
• Trickloader
• Totep
• Totbrick
• TSPY_TRICKLOAD

Threat Actor Attribution

Attribution is probabilistic, not a science. Each link below states its confidence level and the evidence behind it.

• Wizard Spider (Gold Blackburn / UNC1878) High confidence
  Basis: Attributed to the Wizard Spider syndicate; substantiated by the US DOJ federal indictments of core developers Alla Witte and Vladimir Dunaev (convicted in US District Court), and joint US OFAC and UK National Crime Agency (NCA) sanctions against 11 TrickBot leadership figures in 2023. [source]

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Derived From / Upstream Ancestry: Dyre

Known Derivatives & Downstream Variants: Bazarloader · Diavol · Anchor

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1071.001: Implement web filtering and SSL/TLS inspection to detect malicious command and control (C2) traffic hiding in HTTP/HTTPS.
• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Exploited Vulnerabilities (CVEs)

This malware family is documented weaponizing the following common vulnerabilities and exposures:

• CVE-2017-0144 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).
• CVE-2020-1472 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).
• CVE-2019-19781 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).

Command & Control (C2) and Network Profile

How this family talks to its operators. C2 traffic can often identify a family even when its code and configuration are hard to analyse. Ports and patterns are historical and change between campaigns, so use them as hunting leads rather than block-only rules.

Network detection ideas

• Alert on outbound TLS connections to destination ports 447 and 449 from non-perimeter workstations
• Inspect internal DNS traffic for unusually high volumes of long base64/hex-encoded subdomains characteristic of TrickBot Anchor DNS tunneling
• Monitor SMBv1 network activity for signature EternalBlue (CVE-2017-0144) exploitation attempts

Sources: CISA Advisory AA21-076A, US DOJ Wizard Spider / TrickBot Indictments

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

• a287c800b731557997ce79c4a5c9f515949d21bb210ea2a088924b17e47f9f74
• 7f872f2a58b29f7cf7ae046c8fcddbfa9b244d320958dbf4e56598c9460599a8
• f45a6c0b3967520e5e01b332b77a014e7a07ba34237f3743c3327f2c64b6ff92

Delivery vectors

• Malicious spam emails delivering weaponized Word macros or BazarLoader
• Exploitation of external-facing Citrix NetScaler (CVE-2019-19781)

Persistence mechanisms

• Scheduled tasks created via schtasks.exe with non-descript system names
• Service registration disguised as Windows Error Reporting service

Detection Guidance

Detection ideas drawn from public reporting. Tune to your environment before deploying.

• YARA rules from CISA AA21-076A
• Suricata rules for TrickBot module download URIs (/images/ pattern)
• EDR rule for svchost.exe spawned from non-services.exe parent

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_TRICKBOT_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Trickbot"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "trickbot" ascii wide nocase
        $s2 = "trickbot" ascii wide nocase
        $s3 = "trickloader" ascii wide nocase
        $s4 = "totep" ascii wide nocase
        $s5 = "totbrick" ascii wide nocase
        $s6 = "tspy_trickload" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Trickbot (Trojan) Execution & Triage
id: f21666fd-0d42-5abe-a78c-e48e01082199
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Trickbot malware family. Detects suspicious execution from temporary user
  directories with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/trickbot
- https://malware-families-catalog.systemhelpdesk.com/defensive/downloader-dropper-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.trojan
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1566_001
- attack.t1547_001
- attack.t1021_002
- attack.t1210
- attack.t1555_003
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \cscript.exe
    - \wscript.exe
    CommandLine|contains:
    - AppData\Local\Temp
    - -WindowStyle Hidden
    - /e:jscript
    - bitsadmin /transfer
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: medium

rule MALWARE_WIN_TRICKBOT_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Trickbot tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "trickbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate host immediately — TrickBot signals ransomware readiness
2. Reset domain credentials used on the host (treat as compromised)
3. Hunt across the domain for Cobalt Strike beacons
4. Audit Domain Controllers for AnchorDNS C2

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not delay isolation — average dwell-to-ransomware time is under 48 hours
2. Do not assume reimage alone is sufficient without credential rotation
3. Do not skip threat hunt across other endpoints

References & External Analysis

• MITRE ATT&CK: TrickBot (S0266)
• CISA Advisory: AA21-076A: TrickBot Malware
• Search "trickbot" on VirusTotal (External Analysis)
• Search "trickbot" on Any.Run (Sandbox Sandbox)
• Search "trickbot" on MalwareBazaar (Malware Samples)

North American Authority Advisory (CISA / NIST)

The Cybersecurity and Infrastructure Security Agency (CISA) has published an official US federal advisory on this family, which can be mapped to NIST Cybersecurity Framework (CSF) incident response controls: AA21-076A: TrickBot Malware ↗

Frequently Asked Questions

Related Threats (Category: Trojan)

Explore other documented threats in the same operational category:

• Yahoopass
• Tpyn
• Staser
• Joker
• Apropos
• Anyprotect
• Killproc
• Triusor

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/trickbot.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.