Beware of Trik Loader Botnet that protects FUD from Antivirus

A threat actor has claimed to have put the source code for sale for the notorious Trik botnet, also known as Phorpiex, in antivirus (AV) circles. This C++ botnet has a suite of modules that make it a formidable threat to cybersecurity.

The sale was announced on social media by ThreatMon, raising concerns among cybersecurity experts and organizations worldwide.

Main Functions of the Bot

The Trik botnet is a persistent HTTP loader with several malicious capabilities. Unlike many other botnets, it does not require a control panel, making it more difficult to detect and dismantle.

The botnet includes a crypto clipper, a USB emitter, and a PE infector designed to target various cryptocurrency wallets.

One of its most concerning features is its ability to protect itself from detection by most antivirus software, ensuring it remains fully undetectable (FUD).

Every 30 minutes, the loader checks files on the server, decrypting and running them only if the signature is correct. This mechanism ensures that only authorized files are executed, adding another layer of complexity to its detection and removal.

The PE infector works with x86 and x64 PE executables, spreading the infection by embedding the downloader shellcode into these files.

Join our free webinar to learn about combating slow DDoS attacks, a major threat today.

Modules and Additional Threats

The Trik botnet also includes several modules that enhance its malicious capabilities. One such module is the VNC bruteforcer, which scans generated IPs for open VNC ports (5900) and attempts to gain access using encoded credentials.

This module can potentially allow attackers to gain unauthorized access to remote systems, posing significant risks to individuals and organizations.

Another module, the USB emitter, creates a link on USB drives with its icon, along with a hidden folder containing all user items. This feature can spread the infection to any system the USB drive is connected to, further propagating the botnet.

The sale of the Trik botnet source code is a stark reminder of the evolving threats in the cybersecurity landscape. With its advanced capabilities and modules, this botnet poses a significant risk to digital security.

Organizations and individuals are urged to stay vigilant and enhance their cybersecurity measures to protect against such sophisticated threats.

Protect Your Business Emails From Spoofing, Phishing & BEC with AI-Powered Security | Free Demo