3-21-2018: #Trickbot banking malware gtags “ser0321/tt002” v

<mcconf>
    <ver>1000149</ver>
    <gtag>ser0321</gtag>
    <servs>
        <srv>212.14.51.56:443</srv>
        <srv>212.14.51.43:443</srv>
        <srv>109.234.37.80:443</srv>
        <srv>185.174.172.155:443</srv>
        <srv>85.143.217.2:443</srv>
        <srv>194.87.237.55:443</srv>
        <srv>176.103.62.18:443</srv>
        <srv>78.140.221.157:443</srv>
        <srv>149.202.30.10:443</srv>
        <srv>109.234.34.213:443</srv>
    </servs>
    <autorun>
        <module name="systeminfo" ctl="GetSystemInfo" />
        <module name="injectDll" />
    </autorun>
</mcconf>


<mcconf>
    <ver>1000150</ver>
    <gtag>tt0002</gtag>
    <servs>
        <srv>109.173.183.245:449</srv>
        <srv>31.134.60.181:449</srv>
        <srv>85.28.129.209:449</srv>
        <srv>82.214.141.134:449</srv>
        <srv>81.227.0.215:449</srv>
        <srv>31.172.177.90:449</srv>
        <srv>185.55.64.47:449</srv>
        <srv>212.14.51.56:443</srv>
        <srv>212.14.51.43:443</srv>
        <srv>109.234.37.80:443</srv>
        <srv>85.143.217.2:443</srv>
        <srv>194.87.237.55:443</srv>
        <srv>78.140.221.157:443</srv>
        <srv>109.234.34.213:443</srv>
        <srv>185.242.179.143:443</srv>
        <srv>185.174.173.67:443</srv>
        <srv>94.103.82.171:443</srv>
    </servs>
    <autorun>
        <module name="systeminfo" ctl="GetSystemInfo" />
        <module name="injectDll" />
    </autorun>
</mcconf>


<mail>
<handler>185.180.197.58:443</handler>
</mail>