Goal: Reverse the Trickbot Socks5 backconnect module including its communication protocol and source code-level insights. Source: Decoded Trickbot Socks5 backconnect module(33ad13c11e87405e277f002eโฆ
The C2 protocol in BitSightโs Unveiling Socks5Systemz seems to be identical to whatโs described in this old BackDoor.TeamViewer.49 blog post by DrWEB from 2016!
They both even use the same RC4 encryption key heyfg645fdhwi, which can be used to decrypt requests and responses from the C2.
The malware is #TeamSpy, described here: https://blog.avast.com/a-deeper-look-into-malware-abusing-teamviewer
Here's the config:
๐ฝ๐ด๐๐๐ด๐๐ด๐ฒ
Rairii~[RoL]โฎโกโญ