“Sin”-ful SPIDERS Trickbot

“Sin”-ful SPIDERS: WIZARD SPIDER and LUNAR SPIDER Sharing the Same Web

Indicator	Description
http://tfulf[.]host/Sw9HJmXzq.exe	Custom loader URL
4ba234160cfbd1ef8ca2a259e51abdd4f6109ce74954fb7541d6226ec510b755	Custom loader SHA256
http://185.68.93[.]30/sin.png	TrickBot loader URL
http://185.68.93[.]30/win.png	TrickBot loader URL
d06432486e7e9c2b8aaef4f42c11cf8efe19689638a3512ce931a23bdb5f2b4c	TrickBot loader SHA256
185.246.64[.]237:443
68.119.85[.]138:449
65.184.200[.]184:449
185.62.188[.]30:443
96.36.253[.]146:449
92.38.135[.]33:443
24.247.181[.]155:449
31.131.22[.]212:443
208.79.106[.]155:449
192.227.204[.]224:443
124.29.213[.]74:449
46.100.14[.]215:449
190.109.178[.]222:449
103.47.168[.]172:449
208.79.110[.]201:449
204.14.154[.]126:449
103.47.168[.]72:449
103.47.168[.]91:449
46.21.249[.]220:443
107.146.147[.]235:449
185.62.188[.]30:443
68.111.123[.]100:449
103.47.169[.]27:449
24.247.182[.]240:449
36.91.74[.]138:449
125.209.82[.]158:449
76.107.90[.]235:449
47.224.98[.]123:449
185.222.202[.]79:443
24.247.182[.]253:449
216.17.92[.]138:449
199.21.106[.]189:449
208.79.106[.]213:449
24.247.182[.]253:449
136.25.2[.]43:449
181.129.93[.]226:449
170.79.176[.]242:449	TrickBot C2 Servers
f8967874aeeddfa65f492489dfb91de138e34313bf804d3200423c790eb19dce	Customized shareDll module
eefd209ba6afff5830d5510e68b2af90df200550d8ca4c40029baa93a0f01999	sharesinDll32
1b84f604847be0dbdf19ca169deb22b0245ca6f4bc2877b7a0ceeffa0436d7b3	sharesinDll32
ea3c70d82f3b4fe8d0914cc58669da0f3f116aa20f0661d68f826fd55763ef50	sharesinDll32
93da209d2fdb49df19b53089bb1820aa0183e9f207ea87b51b49faa74f8e76ba	sharesinDll64
915e416576be4b459c19941cc86a84fb0d66f54964552be0f69045b89323d2f7	sharesinDll64
6d8551194b12655b4605f046a754257f69b1ee250f21e32466db54797a45c7c0	sharesinDll64
aa074b7a1ce29abd9141dc18ca603f2ed2764ae1afabb92eb2f9e4dc008d99d6	tabtinDll32
ba5bd732466a41636217b639a7a2aff1038a80bc29bd80c0532609d53297051f	tabtinDll32
7023bbd875635b35fdc0eba303143be76afb50c0f34e8d79e8d0daba1d984b60	tabtinDll64
13b8ab8ce0aa9db161c065c6bf2fdbb50c6fd82fe48e4576abc4b8c3136f925e	tabtinDll64
cac2f117d8b4f1fc40dd0921ea91312ad8129df3556444e41fda8d27c81e02cd	wormwinDll32
d51644cefd34dd7e1ec32a3e0336f9c479c196527e8baea6e85937254cecfe99	wormwinDll32
8c20b33374c280e9fd98113304843a339f738647cc13daf8f60312b9fef6b702	wormwinDll64
e8ecceb0cbc0e6aefab5ac47a9e69f7926317d9e4f9a782b8df418c67a8d0661	wormwinDll64