The new version of the banking Trojan TrickBot “kicks off” Windows Defender

The developers of the famous banking Trojan TrickBot are constantly improving their program.This time, the cybercriminals taught the TrickBot to turn off Windows Defender.

MalwareHunter Team investigated this process.

After launching this version of TrickBot, the Trojan performs the following steps:

• Disables and then deletes the WinDefend service.
• Terminates the MsMpEng.exe, MSASCuiL.exe and MSASCui.exe processes.
• Adds the Windows DisableAntiSpyware policy and activates it to disable Windows Defender and other programs.
• Disables security notifications in Windows.
• Disables real-time protection.

“When TrickBot detects certain security programs installed, it will configure a debugger for that process using the Image File Execution Options Registry key. This causes the debugger to launch before the program that is executed, and if that debugger does not exist, the expected program will fail to launch”, — MalwareHunterTeam specialists say.

Bank Trojan was not limited to this activities only. According to MalwareHunter Team experts who conducted reverse engineering of TrickBot, the malware uses as many as 12 additional methods to disable Windows Defender and Microsoft Defender APT.

“As you can see, the developers of TrickBot are constantly monitoring for new tricks and methods to bypass security and keep researchers on their toes and we should expect to see this behavior continue”, — conclude IS experts.

Read also: Banking Trojan TrickBot learned to spam and has already collected 250 million email addresses