TrickBot does not rest. Following the recent addition of its first targeted US-based bank, a new version of the malware has been spotted in the wild.

Now in its 11th incarnation, TrickBot has expanded its ever growing target portfolio yet again – this time increasing its focus on Germany.



Figure 1 – TrickBot configuration, showing its most recent version upgrade


While previously TrickBot’s focus in Germany was distinctly on Sparkassen Finanzgruppe, this latest version now includes more previously untargeted financial institutions in Germany.


de1 de2

de3 de4

de5 de6

Figures 2-7 – TrickBot Dynamic Webinject configuration snippets showing some of its recently added targets in Germany


TrickBot continues to evolve rapidly, constantly adding targets and using varying techniques to pose an ever increasing risk to online banking users and financial institutions in multiple regions across the globe.


Recent TrickBot malware sample MD5s: c044f4a710f3a0b1997a4470145677ea, 07df1af1c3b8c33df61ff4f3f07f3f54


VirusTotal links:


Analysis links:



TrickBot targets its first US bank -

TrickBot targeting Sparkassen Finanzgruppe -

Review of TrickBots rapid evolution -