TrickBot Campaign Uses Fake Payroll Emails to Conduct Phishing Attacks
TrickBot phishing campaign used SendGrid, fake Google Docs, and Drive-hosted downloaders disguised as Word files to deliver a credential-stealing payload.
Unit 42 identified a TrickBot distribution campaign on November 7-8, 2019, using payroll and annual bonus-themed emails sent from likely compromised .edu addresses through the legitimate SendGrid email delivery service. Emails contained links to Google Docs documents linking to downloader executables hosted on Google Drive, further masked behind SendGrid click-tracking URLs. The downloaders, signed by PERISMOUNT LIMITED and displayed with Microsoft Word icons, show a decoy pop-up and retrieve TrickBot payloads from compromised legitimate domains such as savute[.]in and lindaspryinteriordesign[.]com. The newer TrickBot variant stores its files and configuration under %APPDATA%\cashcore.
- Payroll-themed emails delivered via legitimate SendGrid service
- Links chained through Google Docs to malicious Google Drive files
- Downloaders disguised as Word documents with signed executables
- TrickBot payloads fetched from compromised legitimate domains
- New variant stores files under %APPDATA%\cashcore
- ATT&CK
- T1566.002 Spearphishing LinkT1204.002 User Execution: Malicious FileT1105 Ingress Tool TransferT1036 Masquerading
- Vendors
- SendGridPalo Alto Networks
- Malware
- TrickBot
- Organizations
- PERISMOUNT LIMITEDUnit 42
- Countries
- United States
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | clementeolmos.com | this blog. Date Observed C2 Trickbot Payload SHA256 11/7/19 clementeolmos[.]com/supp.php erfd1.exe 24e3fa3fb1df9bd70071e5b957d180cd51bcf1 |
| domain | lindaspryinteriordesign.com | 7a938db9eebe4a0efa573343d89703482cafb2d8 Preview_Report.exe lindaspryinteriordesign[.]com/supp.php nfdusdarm.exe 7d6ff8baebedba414c9f15060f0a847096 |
| domain | maisonmarielouise.org | b093e8da7fb666b2d644197fc3ea22b3931a6150c259479b0c 11/19/19 maisonmarielouise[.]org/supp.php SetupDesktop.exe dc8f259fb55a330d1a8e51d91340465 |
| domain | savute.in | nloader C2 Trickbot Payload File SHA256 StatementReport.exe savute[.]in/supp.php nfdsus12.exe d1e0902fd1e8b3951e2aec057a938db9eeb |
| sha256 | 24e3fa3fb1df9bd70071e5b957d180cd51bcf10bab690fa7db7425ca6652c47c | yload SHA256 11/7/19 clementeolmos[.]com/supp.php erfd1.exe 24e3fa3fb1df9bd70071e5b957d180cd51bcf10bab690fa7db7425ca6652c47c e9fd22631de9c918ac834eb14e01c76aa4d33069c7622daafcd03b4f157 |
| sha256 | 7d6ff8baebedba414c9f15060f0a8470965369cbc1088e9f21e2b5289b42a747 | rt.exe lindaspryinteriordesign[.]com/supp.php nfdusdarm.exe 7d6ff8baebedba414c9f15060f0a8470965369cbc1088e9f21e2b5289b42a747 Table 2. Trickbot Payload Download Locations The two payloa |
| sha256 | b3d2e7158620ece90fbc062892db55bf564c6154eb85facab57a459e3bd1156f | 59fb55a330d1a8e51d913404651b8d785d4ae8c9c655c57b4efbfe71a64 b3d2e7158620ece90fbc062892db55bf564c6154eb85facab57a459e3bd1156f Table 3. Additional Trickbot payloads observed Conclusion B |
| sha256 | b8c2329906b4712caa0f8ca7941553b3ed6da1cd1f5cb70f1409df5bc1f0ee4a | ing Theme File Name SHA256 Annual bonus StatementReport.exe b8c2329906b4712caa0f8ca7941553b3ed6da1cd1f5cb70f1409df5bc1f0ee4a Payroll Preview_Report.exe f8aaf313cc213258c6976cd55c8c0d04 |
| sha256 | d1e0902fd1e8b3951e2aec057a938db9eebe4a0efa573343d89703482cafb2d8 | HA256 StatementReport.exe savute[.]in/supp.php nfdsus12.exe d1e0902fd1e8b3951e2aec057a938db9eebe4a0efa573343d89703482cafb2d8 Preview_Report.exe lindaspryinteriordesign[.]com/supp.php n |
| sha256 | d7687e1d98484b093e8da7fb666b2d644197fc3ea22b3931a6150c259479b0c6 | 2631de9c918ac834eb14e01c76aa4d33069c7622daafcd03b4f1574aad0 d7687e1d98484b093e8da7fb666b2d644197fc3ea22b3931a6150c259479b0c6 dc8f259fb55a330d1a8e51d913404651b8d785d4ae8c9c655c57b4efbfe |
| sha256 | dc8f259fb55a330d1a8e51d913404651b8d785d4ae8c9c655c57b4efbfe71a64 | 11/19/19 maisonmarielouise[.]org/supp.php SetupDesktop.exe dc8f259fb55a330d1a8e51d913404651b8d785d4ae8c9c655c57b4efbfe71a64 b3d2e7158620ece90fbc062892db55bf564c6154eb85facab57a459e3bd |
| sha256 | e9fd22631de9c918ac834eb14e01c76aa4d33069c7622daafcd03b4f1574aad0 | a3fb1df9bd70071e5b957d180cd51bcf10bab690fa7db7425ca6652c47c e9fd22631de9c918ac834eb14e01c76aa4d33069c7622daafcd03b4f1574aad0 d7687e1d98484b093e8da7fb666b2d644197fc3ea22b3931a6150c25947 |
| sha256 | f8aaf313cc213258c6976cd55c8c0d048f61b0f3b196d768fbf51779786b6ac6 | ed6da1cd1f5cb70f1409df5bc1f0ee4a Payroll Preview_Report.exe f8aaf313cc213258c6976cd55c8c0d048f61b0f3b196d768fbf51779786b6ac6 Table 1. Trickbot downloader files Both of these downloader |
From the original article
7 min read at unit42.paloaltonetworks.com
By using a combination of Cortex XDR and the AutoFocus contextual threat intelligence service, Unit 42 discovered a recent Trickbot campaign leveraging legitimate cloud service providers to obfuscate malicious delivery behavior. Trickbot is a well-known, modular credential stealer first discovered in 2016 .
By Bryan Lee, Mike Harbison, Brittany Barbehenn · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.