2020-06-16 Trickbot IOCs

SUBJECTS OBSERVED
Office notification  #  72714

SENDERS OBSERVED
[email protected]

EXCEL MALDOC FILE HASH
workbook_13.xls
097f3773c30aea33b0ab4a0bcd73c4e0

TRICKBOT PAYLOAD
https://pops.works/manahet/omuscreativos.php

TRICKBOT FILE HASH
1333ab4nu59ok.exe
5ebfefd6165826b56658dce374c33cf9

TRICKBOT C2s
http://203.176.135.102:8082/ono47/WIN7PC_W617601.45C53ECFF74734259CB34797A36C2804/90
http://203.176.135.102:8082/ono47/WIN7PC_W617601.45C53ECFF74734259CB34797A36C2804/81/
http://203.176.135.102:8082/jim747/WIN7PC_W617601.F97B577E1419B4CB127BE49CF55CB5D5/90
http://203.176.135.102:8082/jim747/WIN7PC_W617601.F97B577E1419B4CB127BE49CF55CB5D5/81/

http://195.123.221.93:443/ono47/WIN7PC_W617601.45C53ECFF74734259CB34797A36C2804/81/
http://195.123.221.93:443/jim747/WIN7PC_W617601.F97B577E1419B4CB127BE49CF55CB5D5/81/

SUPPORTING EVIDENCE
Open directory here with almost 2,000 Trickbot executables: https://pops.works/manahet/

http://www.malware-traffic-analysis.net/2020/06/16/index.html