The developers of the famous banking Trojan TrickBot are constantly improving their program.This time, the cybercriminals taught the TrickBot to turn off Windows Defender.
Many users rely on Windows Defender, since it is an antivirus built into Windows 10.MalwareHunter Team investigated this process.
After launching this version of TrickBot, the Trojan performs the following steps:
- Disables and then deletes the WinDefend service.
- Terminates the MsMpEng.exe, MSASCuiL.exe and MSASCui.exe processes.
- Adds the Windows DisableAntiSpyware policy and activates it to disable Windows Defender and other programs.
- Disables security notifications in Windows.
- Disables real-time protection.
“When TrickBot detects certain security programs installed, it will configure a debugger for that process using the Image File Execution Options Registry key. This causes the debugger to launch before the program that is executed, and if that debugger does not exist, the expected program will fail to launch”, — MalwareHunterTeam specialists say.
Bank Trojan was not limited to this activities only. According to MalwareHunter Team experts who conducted reverse engineering of TrickBot, the malware uses as many as 12 additional methods to disable Windows Defender and Microsoft Defender APT.
“As you can see, the developers of TrickBot are constantly monitoring for new tricks and methods to bypass security and keep researchers on their toes and we should expect to see this behavior continue”, — conclude IS experts.
Read also: Banking Trojan TrickBot learned to spam and has already collected 250 million email addresses
TrickBot is a banking Trojan that attempts to steal online banking credentials, cryptocurrency wallets, browser information, and other credentials saved on your PC and browser.
