2019-06-07 Trickbot

ATTACHMENT:
Server_Access_Validator_77276.html
144a0b7098ba34579c9d250ee457b222
7e21bac418ba6292dc74aef4b6d20f9970a1e2d2433943403dc6919699a22a9e

-HTML contains embedded .docm

PurchaseSummary.docm
b809f8cdd3b47daf44483efaf73b2a6b
e264f4f5aed488c2b34cfd1093d173c45092a7bd72d5e6f41c775364b01425cb

DOC RUNS MACROS TO CREATE JSCRIPT:
<random_file_name>
d2fdb991884569b31671c39f15324908
069aaa2eee4821f0e650d18421b60efb3f1e8a42dfaf1cde920b5d0cab3ba29d

-jscript performs sandbox checks

JSCRIPT PULLS PAYLOAD FROM:
185.159.82[.]237

PAYLOAD DELIVERED:
7cefe28b26c1d28977eed8231ce67ffe
7a1a960daa1cead0a4a6d16e999cb50f12b9693709fed692cfb80b0b86fdd672

BOTNET:
sat48

VERSION:
1000433

C2s FROM CONFIG:
103.117.232[.]198:449
103.207.169[.]78:449
103.74.89[.]24:449
103.74.89[.]29:449
103.74.89[.]43:449
107.181.175[.]93:443
117.242.39[.]160:449
117.252.68[.]65:449
146.196.122[.]152:449
149.202.225[.]162:443
164.132.138[.]136:443
176.31.213[.]238:443
177.103.240[.]149:449
177.12.82[.]27:449
177.183.194[.]194:449
177.52.79[.]29:449
180.250.197[.]188:449
181.112.145[.]222:449
181.115.168[.]69:449
181.129.140[.]140:449
181.129.49[.]98:449
181.129.93[.]226:449
181.196.61[.]110:449
185.255.79[.]22:443
186.138.152[.]228:449
186.183.199[.]114:449
186.42.186[.]202:449
186.42.226[.]46:449
187.58.56[.]26:449
187.65.49[.]88:449
189.80.134[.]122:449
190.12.29[.]70:449
190.13.160[.]19:449
190.154.203[.]218:449
191.37.181[.]152:449
195.123.245[.]135:443
200.35.56[.]81:449
36.89.85[.]103:449
45.250.66[.]10:449
51.83.138[.]148:443
80.87.197[.]224:443
85.143.219[.]252:443
89.223.94[.]15:443
92.119.113[.]106:443
92.63.99[.]106:443
93.189.43[.]59:443