Trickbot ver. 1000048, gtag tt0002 - Decrypted configs

trickbot_1000048.xml

<mcconf>
<ver>1000048</ver>
<gtag>tt0002</gtag>
<servs>
<srv>91.83.88.51:449</srv>
<srv>147.135.196.128:443</srv>
<srv>195.133.147.135:443</srv>
<srv>185.158.113.62:443</srv>
<srv>194.87.146.180:443</srv>
<srv>194.87.99.220:443</srv>
<srv>194.87.95.122:443</srv>
<srv>194.87.111.6:443</srv>
<srv>195.133.197.187:443</srv>
<srv>194.87.99.210:443</srv>
<srv>169.239.129.42:443</srv>
<srv>5.152.210.188:443</srv>
<srv>178.156.202.98:443</srv>
<srv>103.208.86.198:443</srv>
<srv>185.99.2.62:443</srv>
<srv>93.171.216.33:443</srv>
<srv>94.140.125.5:443</srv>
<srv>93.171.217.20:443</srv>
<srv>194.87.236.114:443</srv>
<srv>195.133.145.103:443</srv>
<srv>194.87.237.138:443</srv>
<srv>194.87.98.225:443</srv>
<srv>206.217.137.39:443</srv>
<srv>155.94.238.11:443</srv>
</servs>
<autorun>
<module name="systeminfo" ctl="GetSystemInfo"/>
<module name="injectDll"/>
</autorun>
</mcconf>

http://103.27.235.75/385.png (AES encrypted)

<dpost>
<handler>http://185.80.128.230:8082</handler>
</dpost>

<mail>
<handler>185.80.128.230:443</handler>
</mail>

<servconf>
<expir>1514678400</expir>
<plugins>
<psrv>198.24.151.205:447</psrv>
<psrv>217.12.221.45:447</psrv>
<psrv>103.208.86.36:447</psrv>
<psrv>155.94.238.17:447</psrv>
<psrv>185.82.217.212:447</psrv>
<psrv>89.46.222.18:447</psrv>
<psrv>89.46.222.227:447</psrv>
</plugins>
</servconf>

<bcservers>
<srv ip="66.85.27.117" port="447"/>
</bcservers>