The latest version of the Trickbot banking Trojan allows malicious users to lock the screen of the targeted computer.
The screenlocker is part of a multi-file mechanism that brings TrickBot to victims' computers.
TrickBot, although known primarily as a banking trojan, has also evolved into a malware dropper in recent years. Trickbot operators infect computers with malware that specializes in downloading various add-ons for TrickBot. Previously known variants include the original banking trojan, a spamming email engine, and a worm virus that spreads via the SMB protocol across networks.
On March 15, the initial dropper started downloading a file named tabDll32.dll (or tabDll64.dll) which in turn downloaded three other files named:
Spreader_x86.dll – File that attempts to spread to other computers on the same network via SMB, leveraging the EternalRomance exploit.
SsExecutor_x86.exe – Gets automatically started every time the computer starts.
ScreenLocker_x86.dll – TrickBot's new feature that locks the screen of the infected computer. It does not encrypt files.
What stands out is the fact that TrickBot already had an SMB worm from the summer of 2017, called wormDll32.dll, to spread, which leads security researchers to believe that these 3 files are a completely autonomous and separate process. Specifically, they appear to be designed to work together and execute one after the other, ignoring the original worm.
The good news is that the screenlocker code is not yet fully functional and appears to be still under construction, nor do we encounter any encryption to be considered ransomware, however Jason Davidson from Webroot expresses his concern, saying "If the TrickBot developers complete this screenlock function, this will create a big problem as it seems that its main target will be vulnerable corporate networks.".
