Trickbot

Overview

TrickBot is a trojan/spyware program written in C++ that, per MITRE ATT&CK, first emerged in September 2016 as a possible successor to Dyre. It was developed and initially used by the actor known as Wizard Spider to target banking sites in North America, Australia, and Europe, and has since been used worldwide across all sectors as part of 'big game hunting' ransomware campaigns. TrickBot is highly modular, supporting credential theft, network reconnaissance, and delivery of further payloads. It has frequently been paired with Emotet for initial access and preceded ransomware such as Ryuk and Conti.

Known aliases

Threat reports may refer to this family under multiple names:

• TrickBot
• Totbrick
• TSPY_TRICKLOAD

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1071.001: Implement web filtering and SSL/TLS inspection to detect malicious command and control (C2) traffic hiding in HTTP/HTTPS.
• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure.

Delivery vectors

• Malspam with Excel macros
• Emotet-delivered secondary payload
• BazarLoader follow-on

Network indicators

• HTTPS to C2 on ports 443, 447, 449
• Self-signed certs with randomized CN

Persistence mechanisms

• Scheduled task in \Microsoft\Windows path with legitimate-looking name
• Service entry with random 8-char name

Detection Guidance

Detection ideas drawn from public reporting. Tune to your environment before deploying.

• YARA rules from CISA AA21-076A
• Suricata rules for TrickBot module download URIs (/images/ pattern)
• EDR rule for svchost.exe spawned from non-services.exe parent

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_TRICKBOT {
    meta:
        description = "Detects Trickbot (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "trickbot" ascii wide nocase
        $s2 = "trickbot" ascii wide nocase
        $s3 = "totbrick" ascii wide nocase
        $s4 = "tspy_trickload" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Trickbot Activity
id: d073f7352b82c1b8eedda381590adced
status: experimental
description: Detects generic indicators of the trickbot malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*trickbot*"
            - "*trickbot*"
            - "*totbrick*"
            - "*tspy_trickload*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate host immediately — TrickBot signals ransomware readiness
2. Reset domain credentials used on the host (treat as compromised)
3. Hunt across the domain for Cobalt Strike beacons
4. Audit Domain Controllers for AnchorDNS C2

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not delay isolation — average dwell-to-ransomware time is under 48 hours
2. Do not assume reimage alone is sufficient without credential rotation
3. Do not skip threat hunt across other endpoints

References & External Analysis

• MITRE ATT&CK: TrickBot (S0266)
• Search "trickbot" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Bototer
• Siplog
• Genericrxce
• Redator
• Installflash

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/trickbot.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.