# TrickBot adds Zeus-style webinject configs (winj) to injectDll32/injectDll64 webinject module

> Kryptos Logic reports that TrickBot, a modular trojan active since 2016 that moved from bank fraud toward ransomware enablement, revived and updated its webinject module to support Zeus-style webinject configs. The module, deployed as injectDll32/injectDll64, replaces the sinj and dinj config files with a unified winj config and shares substantial code with IcedID/Bokbot's Man-in-the-Browser webinject module.

- **Published:** 2026-10-17T20:55:29Z
- **Last reviewed:** 2026-10-17T20:55:29Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3838
- **ID:** TL-2026-3838
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

TrickBot is an established, widespread multi-purpose modular trojan observed since 2016, reusing code from the Dyre/Dyreza banking trojan that went offline in 2015. It began as a banking trojan and its operators later used it as an access broker for ransomware; the Center for Internet Security (MS-ISAC) observed from June 2019 an increasingly close relationship between initial TrickBot infections and Ryuk ransomware attacks, with Conti also named as a follow-on strain. Initial infection commonly arrives via malspam with macro-enabled Office documents that run a base64-obfuscated VBScript to download TrickBot, and Emotet frequently distributed TrickBot as a secondary payload. CIS also documents scheduled-task persistence, attempts to disable Windows Defender, SMB/LDAP lateral movement (TabDll with EternalRomance, CVE-2017-0147), Mimikatz-based LSASS credential scraping and browser cookie harvesting. U.S. Cyber Command and private-sector partners conducted takedown operations against TrickBot in fall 2020.

In June 2021 the Kryptos Logic Vantage Team observed new development of TrickBot's webinject capability, work that had previously been shelved for over a year. The updated module was pushed to real victims as injectDll32 (32-bit) and injectDll64 (64-bit), superseding the older webinject module. Previously, webinject configuration was split across two files: sinj (static injects) and dinj (dynamic injects). The new module uses a single config named winj written in Zeus-style syntax (set_url <target-url> GP, followed by data_before, data_end, data_after and data_inject blocks; a depend field supplies a C2 URL for GET requests). A separate dpost config defines handler C2s that receive the webinject results. Debug builds referred to the Zeus-style configs as 'zeus'. The module requests its configs from the C2 using the format https://<c2_address>/<gtag>/<unique_bot_id>/5/injectDll64/.

The module implements Man-in-the-Browser functionality. It proxies browser traffic through a local SOCKS server, hooks socket APIs to redirect connections, modifies traffic for URLs that match the config, and for HTTPS creates a self-signed TLS certificate that it adds to the certificate store. It also patches certificate validation functions (CertVerifyCertificateChainPolicy, CertGetCertificateChain) so the browser raises no warning. Kryptos Logic documented substantial code overlap with IcedID/Bokbot's Man-in-the-Browser webinject module; IcedID/Bokbot uses analogous sinXX/tinXX/winXX config naming. Debug builds of the 32-bit and 64-bit modules were also observed, and the analysis supplied a YARA string referencing the debug path c:\developer\webinject\http-lib\parser.c and the filename pattern wbi-x(86|64).dll.

A follow-up Kryptos Logic deep dive (analysis dated 2022-01-24) details the mechanics of the winj-era module: reflective DLL injection into Internet Explorer, Firefox, Chrome and Edge (skipping Tor Browser); overwriting BaseThreadInitThunk in Firefox before injecting to evade its remote-thread detection; restarting Chrome with --disable-http2, --disable-quic and --enable-logging; a local proxy bound to 127.0.0.1:15733 using a modified SOCKS4 handshake (browser type byte plus browser PID, reply 005a000000000000); hooks on Connect/ConnectEx, WSAIoctl, CertGetCertificateChain and CertVerifyCertificateChainPolicy; rewriting Expect-CT, Public-Key-Pins and Public-Key-Pins-Report-Only response headers so certificate-transparency and pinning checks are defeated; replacement of Firefox CA certificates via nss3.dll APIs; and a multistage JavaScript injection chain (stage 1 beacon to s1.deadseaproductions.com with X-Client-Id/X-Client-Origin headers, stage 2 from myca.adprimblox.fun, stage 3 jQuery payload from akama.pocanomics.com). dpost command 60 exfiltrates Base64-encoded POST data to https://<c2>:<port>/<gtag>/<botid>/60/.

The 2021 source article states no CVEs, IP addresses, domains or CVSS score; the domains above come from the 2022 follow-up. The severity is an analyst assignment and not stated in the source. This record is historical/background coverage of a TrickBot capability change. BeaconBeagle was queried for s1.deadseaproductions.com and returned no matching configs (empty result).

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.005 Visual Basic
- T1053.005 Scheduled Task
- T1055.001 Dynamic-link Library Injection
- T1620 Reflective Code Loading
- T1553.004 Install Root Certificate
- T1685 Disable or Modify Tools
- T1112 Modify Registry
- T1056.004 Credential API Hooking
- T1557 Adversary-in-the-Middle
- T1539 Steal Web Session Cookie
- T1003.001 LSASS Memory
- T1185 Browser Session Hijacking
- T1090.001 Internal Proxy
- T1071.001 Web Protocols

## Sources

- [TrickBot and Zeus (Kryptos Logic)](https://www.kryptoslogic.com/blog/2021/07/trickbot-and-zeus/)
- [TrickBot and Zeus (Kryptos Logic, alternate URL)](https://www.kryptoslogic.com/blog/2021/06/trickbot-and-zeus)
- [Deep Dive into Trickbot's Web Injection (Kryptos Logic)](https://www.kryptoslogic.com/blog/2022/01/deep-dive-into-trickbots-web-injection/)
- [TrickBot: Not Your Average Hat Trick - A Malware with Multiple Hats (CIS)](https://www.cisecurity.org/blog/trickbot-not-your-average-hat-trick-a-malware-with-multiple-hats/)
- [Security Primer: TrickBot (CIS white paper)](https://cisecurity.org/white-papers/security-primer-trickbot)
- [Banking Trojan Techniques (Unit 42)](https://unit42.paloaltonetworks.com/banking-trojan-techniques/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3838