Trickbot, which appeared this year, seems to be a new, more modular, and more extensible malware descendant of the notorious Dyre botnet trojan. Like Dyre, Trickbot communicates with its command-and-control network over TLS-encrypted channels, which it uses both to exfiltrate an enormously detailed profile of the infected machine and any stolen data, as well as to receive payloads and instructions.
This session will comprise a walkthrough of a typical Trickbot infection process, and its aftermath, as seen through the lens of a tool used to perform man-in-the-middle decryption. To collect this information, I infected a number of both virtual and bare-metal devices with Trickbot and then permitted the infected machines to beacon for anywhere from a few hours to a few weeks, all the while MITM-ing the traffic and recording it on a retrospective analysis tool. Finally, we will report our observations about the general behavioural rules that Dyre follows, and offer practical advice to incident responders or malware analysts who might need to identify a Trickbot infection, or deal with the consequences of its aftermath.