Trickbot ver. 1000040, gtag tt0002 - Decrypted configs

trickbot_1000040.xml

--------------------
Main conf :
--------------------
<mcconf>
<ver>1000040</ver>
<gtag>tt0002</gtag>
<servs>
<srv>84.238.198.166:449</srv>
<srv>91.139.236.92:449</srv>
<srv>84.40.65.85:449</srv>
<srv>107.181.246.213:443</srv>
<srv>51.254.164.249:443</srv>
<srv>194.87.92.113:443</srv>
<srv>194.87.144.16:443</srv>
<srv>37.59.183.142:443</srv>
<srv>5.152.210.169:443</srv>
<srv>149.56.122.114:443</srv>
<srv>46.105.238.157:443</srv>
<srv>185.61.149.37:443</srv>
<srv>91.219.28.83:443</srv>
<srv>195.133.48.94:443</srv>
<srv>194.87.103.84:443</srv>
<srv>185.61.148.94:443</srv>
<srv>195.123.212.182:443</srv>
<srv>67.21.68.109:443</srv>
<srv>162.213.213.128:443</srv>
<srv>188.165.62.15:443</srv>
<srv>195.181.246.135:443</srv>
<srv>210.16.102.247:443</srv>
</servs>
<autorun>
<module name="systeminfo" ctl="GetSystemInfo"/>
<module name="injectDll"/>
</autorun>
</mcconf>

--------------------
Plugin conf :
--------------------
<servconf>
<expir>1514678400</expir>
<plugins>
<psrv>188.165.62.11:447</psrv>
<psrv>5.152.210.165:447</psrv>
<psrv>172.93.37.143:447</psrv>
<psrv>79.124.78.81:447</psrv>
<psrv>210.16.101.88:447</psrv>
</plugins>
</servconf>

--------------------
Bot update :
--------------------
http://213.252.246.182/373.png (AES encrypted)

--------------------
Dpost :
--------------------
<dpost>
<handler>http://93.123.73.16:8082</handler>
</dpost>

--------------------
Mail conf :
--------------------
<mail> 
<handler>93.123.73.16:443</handler>
</mail>