Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- I. First-Stage Loader:
- request[.]doc (b72b2fd486fe10fac16e230e9058ee3c)
- II. Second-Stage Loader (inject -> IcedID/BokBot):
- hxxp://tagamol[.]com/chans[.]exe
- III. Download and Execute:
- hxxp://185[.]177[.]216[.]187/out/pir4[.]exe
- TrickBot "pir4" -> "tt0002":
- <mcconf>
- <ver>1000195</ver>
- <gtag>tt0002</gtag>
- <servs>
- <srv>2087511770:449</srv>
- <srv>9255251211:449</srv>
- <srv>11891178139:449</srv>
- <srv>9411252197:449</srv>
- <srv>17610021025:449</srv>
- <srv>1383429172:443</srv>
- <srv>209121142202:449</srv>
- <srv>5102177205:449</srv>
- <srv>209121142214:449</srv>
- <srv>9516118042:449</srv>
- <srv>20386222142:443</srv>
- <srv>4620207204:443</srv>
- <srv>689673154:449</srv>
- <srv>18542192194:449</srv>
- <srv>682273146:449</srv>
- <srv>10714449162:443</srv>
- <srv>467217517:449</srv>
- <srv>14448518:443</srv>
- <srv>46243179212:449</srv>
- <srv>8117725576:449</srv>
- <srv>18524925577:443</srv>
- <srv>8093182201:443</srv>
- <srv>3723011687:443</srv>
- <srv>2171073421:443</srv>
- <srv>217107346:443</srv>
- <srv>8214658155:443</srv>
- <srv>19554162116:443</srv>
- <srv>8087195247:443</srv>
- <srv>18517417242:443</srv>
- <srv>3746134142:443</srv>
- <srv>6210918210:443</srv>
- </servs>
- <autorun>
- <module name="systeminfo" ctl="GetSystemInfo" />
- <module name="injectDll" />
- </autorun>
- </mcconf>
- Plugin:
- <psrv>185.159.129.149:447</psrv>
- <psrv>82.202.236.81:447</psrv>
- <psrv>185.228.233.169:447</psrv>
- <psrv>85.143.214.133:447</psrv>
- <psrv>185.174.172.226:447</psrv>
- <psrv>185.243.131.171:447</psrv>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement