{"id":8530,"date":"2017-08-01T12:10:01","date_gmt":"2017-08-01T20:10:01","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/08\/01\/news-2304\/"},"modified":"2017-08-01T12:10:01","modified_gmt":"2017-08-01T20:10:01","slug":"news-2304","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2017\/08\/01\/news-2304\/","title":{"rendered":"TrickBot comes with new tricks – attacking Outlook and browsing data"},"content":{"rendered":"

Credit to Author: Malwarebytes Labs| Date: Tue, 01 Aug 2017 19:10:43 +0000<\/strong><\/p>\n

Last year we reported about a new modular malware using a network protocol similar to Dyreza – you can read about it here<\/a>. The malware was not very stealthy and some parts were looking to be under development, but we noticed it’s potential and capability to be easily extended. Indeed, authors of TrickBot are persistent not only in spreading their product but also in developing new features.<\/p>\n

Some of the novel changes have been noted in the report of Security Art Work<\/em> (available here<\/a>).<\/p>\n

In addition, it has been found, that developers added to the bot a worm module<\/a> – probably inspired by the success of worm-equipped ransomware (WannaCry<\/a>, EternalPetya<\/a>).<\/p>\n

But authors of the malware didn’t stop on this – recently we captured some additions – for example, the one called Outlook.dll. While most of the modules are written in C++, this one is written in Delphi. It may indicate that the team of developers gained some new members that are more comfortable with this particular language.<\/p>\n

Analyzed samples<\/h3>\n