trickbot loader
6356ed6ca05c8f87f1ae34aa1f3c4a119c5b6e811b00cb996ba688cc6695f683
unpacked
b2918fe27d450de9b9b185930fad4b4f4dd4a8cfeda2c137fad08492370558f5

<mcconf>
<ver>1000013</ver>
<gtag>ser17</gtag>
<servs>
<srv>58.52.155.163:443</srv>
<srv>217.29.220.255:443</srv>
<srv>59.61.184.228:443</srv>
<srv>190.138.249.45:443</srv>
<srv>200.119.236.86:443</srv>
<srv>36.66.107.162:443</srv>
<srv>200.112.228.69:443</srv>
<srv>59.40.249.231:443</srv>
<srv>59.41.202.198:443</srv>
<srv>221.179.156.39:443</srv>
</servs>
<autorun>
<module name="systeminfo" ctl="GetSystemInfo"/>
<module name="injectDll"/>
</autorun>
</mcconf>


of those, these seem to be up.
190.138.249.45   daceballos@HOTMAIL.COM
200.119.236.86   netadmin@GRUPOGTD.COM
36.66.107.162    febrian.setiadi@telkom.co.id