7-2-2018: #TrickBot 1000221 & module IOCs

<mcconf>
<ver>1000221</ver>
<gtag>tt0002</gtag>
<servs>
<srv>138.34.32.218:443</srv>
<srv>178.78.202.189:443</srv>
<srv>47.40.90.210:443</srv>
<srv>93.109.242.134:443</srv>
<srv>45.36.155.244:443</srv>
<srv>158.58.131.54:443</srv>
<srv>46.59.89.119:449</srv>
<srv>208.78.58.170:443</srv>
<srv>45.56.2.247:443</srv>
<srv>109.86.227.152:443</srv>
<srv>83.172.125.227:443</srv>
<srv>200.2.126.98:443</srv>
<srv>62.31.150.202:443</srv>
<srv>90.69.224.122:443</srv>
<srv>194.68.23.182:443</srv>
<srv>182.253.210.130:449</srv>
<srv>67.159.157.150:443</srv>
<srv>212.87.169.31:443</srv>
<srv>201.174.70.238:443</srv>
<srv>138.34.32.74:443</srv>
<srv>185.129.193.221:443</srv>
<srv>187.163.215.32:443</srv>
<srv>199.250.230.169:443</srv>
<srv>95.213.199.95:443</srv>
<srv>193.233.60.40:443</srv>
<srv>85.143.216.131:443</srv>
<srv>212.92.98.189:443</srv>
<srv>109.234.34.106:443</srv>
<srv>62.109.26.128:443</srv>
</servs>
<autorun>
<module name="systeminfo" ctl="GetSystemInfo"/>
<module name="injectDll"/>
</autorun>
</mcconf>


Payload Module Stager IOCs:
http://109.234.36.103/worming.png
http://109.234.36.103/table.png
http://109.234.36.103/toler.png