Trickbot ver. 1000042, gtag tt0002 - Decrypted configs

trickbot_1000042.xml

--------------------
Main conf :
--------------------
<mcconf>
<ver>1000042</ver>
<gtag>tt0002</gtag>
<servs>
<srv>84.238.198.166:449</srv>
<srv>91.139.236.92:449</srv>
<srv>84.40.65.85:449</srv>
<srv>51.254.164.249:443</srv>
<srv>46.105.238.157:443</srv>
<srv>188.165.62.15:443</srv>
<srv>79.124.78.83:443</srv>
<srv>185.86.151.205:443</srv>
<srv>149.56.167.227:443</srv>
<srv>37.59.80.97:443</srv>
<srv>5.2.76.29:443</srv>
<srv>188.165.62.46:443</srv>
<srv>162.213.213.146:443</srv>
<srv>93.123.73.33:443</srv>
<srv>192.157.230.81:443</srv>
<srv>94.176.235.31:443</srv>
<srv>195.133.197.70:443</srv>
<srv>37.59.80.96:443</srv>
<srv>131.153.40.196:443</srv>
<srv>193.124.117.86:443</srv>
<srv>64.56.77.209:443</srv>
</servs>
<autorun>
<module name="systeminfo" ctl="GetSystemInfo"/>
<module name="injectDll"/>
</autorun>
</mcconf>

--------------------
Plugin conf :
--------------------
<servconf>
<expir>1514678400</expir>
<plugins>
<psrv>188.165.62.11:447</psrv>
<psrv>199.181.238.179:447</psrv>
<psrv>89.46.222.232:447</psrv>
<psrv>79.124.78.81:447</psrv>
<psrv>210.16.101.88:447</psrv>
</plugins>
</servconf>

--------------------
Bot update :
--------------------
http://83.149.99.241/375.png (AES encrypted)

--------------------
Dpost :
--------------------
<dpost>
<handler>http://64.56.77.161:8082</handler>
</dpost>

--------------------
Mail conf :
--------------------
<mail> 
<handler>64.56.77.161:443</handler>
</mail>