Technical analysis by the Malware Hunter JAMESWT

False email from the US Internal Revenue Service (IRS) on Covid-19 conveys Trickbot. The xlsb attachment contacts a single url and downloads the dll, which starts the malware infection

A fake email from the US Internal Revenue Service (IRS) on taxation policies related to the Covid-19 emergency conveys the new cybercrime Trickbot campaign.

The xlsb attachment, if opened, contacts a single url and downloads the dll, which starts the malware infection.

Trickbot is a banking trojan originally created only to steal codes and credentials. Over time, however, it has evolved into a modular botnet, which allows – among other things – to download other payloads to the infected computer.

The Malware C2s