https://github.com/MalwareTech/TrickBot-Toolkit

A collection of tools for dealing with TrickBot
https://github.com/MalwareTech/TrickBot-Toolkit

Last synced: about 2 months ago
JSON representation

A collection of tools for dealing with TrickBot

• Host: GitHub
• URL: https://github.com/MalwareTech/TrickBot-Toolkit
• Owner: MalwareTech
• Created: 2017-11-10T03:31:51.000Z (about 7 years ago)
• Default Branch: master
• Last Pushed: 2017-11-11T13:00:24.000Z (about 7 years ago)
• Last Synced: 2024-08-03T23:07:36.443Z (5 months ago)
• Language: Python
• Size: 7.81 KB
• Stars: 198
• Watchers: 16
• Forks: 42
• Open Issues: 1
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-csirt - A collection of tools for working with TrickBot

README

        
# TrickBot

A collection of tools for working with TrickBot

## ConfigDecrypter.py

**Used to decrypt TrickBot configs (found in install directory under then name config.conf)**

Example usage: ConfigDecrypter.py -input config.conf -output config.txt

## FileDownloader.py

**Used to download files from command and control server**

For it to work you'll need to fill servers.txt with a list of recent servers (TrickBot servers die very quickly)

-o (--output) is the file to save to.

-f (--file) specifes the file to download, here is a list of files available: 

* Modules

  * systeminfo32 - gather information about the infected system (32-bit module)

  * injectdll32 - injects into the browser and performs webinjects (32-bit module)

  * mailsearcher32 - searches through files to gather a list of email addresses (32-bit module)

  * sharedll32 - allows the malware to move laterally via network shares (32-bit module)

  

* Config Files

  * main - main TrickBot config which includes the latest server list

  * dinj - dynamic webinject configuration

  * sinj - static webinject configuration

  * dpost - server which the dynamic webinjects will send intercepted requests to

  * mailconf - server to send harvested email list to