2021-05-05 Trickbot IOCs

THREAT IDENTIFICATION:  TRICKBOT

TRICKBOT GTAG
gtag: rob72

SUBJECTS OBSERVED
[#TN#9217724#GEN

SENDERS OBSERVED
info@rock-o-rama.net

MALDOC FILE HASHES
3128117926_1127128272.xlsm
031bb042ecdda96d89ea759c79f45261

TRICKBOT PAYLOAD FILE HASHES
Nioka.meposv
af770c0cf74689a62e0339e59ade60fd

image2.bmp
98e7b944113b0a9d26ed50909e4d30bc

TRICKBOT MODULE FILE HASHES
tabDll64
98173c732d2dbe14a1327a652046738c

wormDll64
65157248a7e65d45067cb495870d032b

networkDll64
c9e79d2f60b6630116aaee9abb02a06f

shareDll64
e126d5fc4a4d20925ebd7e5bcdc0d16a

ADDITIONAL DOWNLOADS
http://192.119.171.206/images/redbutton.png
http://192.119.171.206/images/cutscroll.png
http://192.119.171.206/ico/viodifot

ADDITIONAL FILE HASHES
cutscroll.png
f22cedaec475d7a55b5464cb2858fa56

redbutton.png
0eb145602076b0b5bc1d5f319f847ecd

viodifot
88263ba0eb7638901f5668f3625c60de

TRICKBOT C2s
http://103.102.220.50:443
http://5.202.120.150:443
http://36.95.27.243:443