Skip to main content

Trickbot Tracker




The C2i published in these lists are extracted from the malicious binaries. These executables are the TrickBot malware.
Lists are NOT deduped. 

April 2021
https://194.87.99.210 
https://195.133.197.187 
https://91.83.88.51:449 
https://194.87.99.62 
https://185.158.113.62 
https://185.15.245.103 
https://185.15.245.102 
https://169.239.129.42 
https://147.135.196.128 
https://194.87.99.220 
https://199.48.160.60 
https://94.242.224.218 
https://194.87.239.114 
https://194.87.146.180 
https://193.19.118.207 
https://195.133.48.80 
https://178.156.202.97 
https://194.87.95.122 
https://195.133.147.135 
https://194.87.95.120 
https://194.87.111.6 
https://194.87.99.62:443 
https://185.15.245.103:443 
https://195.133.197.187:443 
https://91.83.88.51:449 
https://194.87.99.210:443 
https://169.239.129.42:443 
https://195.133.147.135:443 
https://147.135.196.128:443 
https://194.87.99.220:443 
https://185.15.245.102:443 
https://194.87.146.180:443 
https://193.19.118.207:443 
https://194.87.239.114:443 
https://94.242.224.218:443 
https://195.133.48.80:443 
https://194.87.95.122:443 
https://194.87.111.6:443 
https://194.87.95.120:443 
https://178.156.202.97:443 
https://199.48.160.60:443 
https://185.158.113.62:443 
https://194.87.99.62:443 
https://185.15.245.103:443 
https://195.133.197.187:443 
https://91.83.88.51:449 
https://194.87.99.210:443 
https://169.239.129.42:443 
https://195.133.147.135:443 
https://147.135.196.128:443 
https://194.87.99.220:443 
https://185.15.245.102:443 
https://194.87.146.180:443 
https://193.19.118.207:443 
https://194.87.239.114:443 
https://94.242.224.218:443 
https://195.133.48.80:443 
https://194.87.95.122:443 
https://194.87.111.6:443 
https://194.87.95.120:443 
https://178.156.202.97:443 
https://199.48.160.60:443 
https://185.158.113.62:443 
https://210.16.102.251 
https://188.165.62.8 
https://37.59.80.96 
https://84.40.65.85:449 
https://172.82.152.171 
https://178.156.202.206 
https://149.56.167.227 
https://188.165.62.15 
https://84.238.198.166:449 
https://46.105.238.157 
https://178.156.202.114 
https://5.152.210.176 
https://89.46.222.246 
https://89.46.222.240 
https://66.85.27.165 
https://91.139.236.92:449 
https://199.181.238.224 
https://67.21.84.23 
https://188.165.62.46 
https://51.254.164.249 
https://199.181.238.221 
Oct 2020 Wk3
https://138.201.44.28 
 https://61.6.127.42 
 https://104.250.138.194 
 https://193.107.111.164 
 https://37.109.52.75 
 https://36.37.176.6 
 https://213.204.124.24 
 https://85.132.136.5 
 https://5.12.28.0 
 https://61.6.53.249 
 https://68.179.234.69 
 https://46.22.211.34 
 https://213.174.21.162 
 https://74.56.177.32 
https://36.37.176.6 
 https://192.189.25.108 
 https://192.189.25.143 
 https://192.189.25.142 
 https://207.35.75.110 
 https://43.241.244.187 
 https://202.5.50.55 
 https://192.152.0.136 
 https://43.231.57.105 
 https://154.66.108.172 
 https://219.93.24.2 
 https://202.40.187.110 
https://36.37.176.6 
 https://192.189.25.108 
 https://192.189.25.143 
 https://192.189.25.142 
 https://207.35.75.110 
 https://43.241.244.187 
 https://202.5.50.55 
 https://192.152.0.136 
 https://43.231.57.105 
 https://154.66.108.172 
 https://219.93.24.2 
 https://202.40.187.110 
https://36.37.176.6 
 https://192.189.25.108 
 https://192.189.25.143 
 https://192.189.25.142 
 https://207.35.75.110 
 https://43.241.244.187 
 https://202.5.50.55 
 https://192.152.0.136 
 https://43.231.57.105 
 https://154.66.108.172 
 https://219.93.24.2 
 https://202.40.187.110 
https://36.37.176.6 
 https://192.189.25.108 
 https://192.189.25.143 
 https://192.189.25.142 
 https://207.35.75.110 
 https://43.241.244.187 
 https://202.5.50.55 
 https://192.152.0.136 
 https://43.231.57.105 
 https://154.66.108.172 
 https://219.93.24.2 
 https://202.40.187.110 
https://36.37.176.6 
 https://192.189.25.108 
 https://192.189.25.143 
 https://192.189.25.142 
 https://207.35.75.110 
 https://43.241.244.187 
 https://202.5.50.55 
 https://192.152.0.136 
 https://43.231.57.105 
 https://154.66.108.172 
 https://219.93.24.2 
 https://202.40.187.110 
https://36.37.176.6 
 https://192.189.25.108 
 https://192.189.25.143 
 https://192.189.25.142 
 https://207.35.75.110 
 https://43.241.244.187 
 https://202.5.50.55 
 https://192.152.0.136 
 https://43.231.57.105 
 https://154.66.108.172 
 https://219.93.24.2 
 https://202.40.187.110 
https://36.37.176.6 
 https://192.189.25.108 
 https://192.189.25.143 
 https://192.189.25.142 
 https://207.35.75.110 
 https://43.241.244.187 
 https://202.5.50.55 
 https://192.152.0.136 
 https://43.231.57.105 
 https://154.66.108.172 
 https://219.93.24.2 
 https://202.40.187.110 
https://37.1.209.51 
 https://36.37.176.6 
 https://104.250.138.194 
 https://91.219.28.77 
 https://37.109.52.75 
 https://138.201.44.28 
 https://5.12.28.0 
 https://68.179.234.69 
 https://46.22.211.34 
 https://213.174.21.162 
 https://193.9.28.24 
 https://188.116.23.98 
https://36.37.176.6 
 https://192.189.25.108 
 https://192.189.25.143 
 https://192.189.25.142 
 https://207.35.75.110 
 https://43.241.244.187 
 https://202.5.50.55 
 https://192.152.0.136 
 https://43.231.57.105 
 https://154.66.108.172 
 https://219.93.24.2 
 https://202.40.187.110 
https://36.37.176.6 
 https://192.189.25.108 
 https://192.189.25.143 
 https://192.189.25.142 
 https://207.35.75.110 
 https://43.241.244.187 
 https://202.5.50.55 
 https://192.152.0.136 
 https://43.231.57.105 
 https://154.66.108.172 
 https://219.93.24.2 
 https://202.40.187.110 
https://58.52.155.163:443 
 https://59.40.249.231:443 
 https://59.41.202.198:443 
 https://217.29.220.255:443 
 https://190.138.249.45:443 
 https://59.61.184.228:443 
 https://221.179.156.39:443 
 https://200.119.236.86:443 
 https://200.112.228.69:443 
 https://36.66.107.162:443

JUL 2020 Wk 4

hxxps://176.120.126.21:449
hxxps://179.43.147.249
hxxps://185.34.52.20
hxxps://80.87.199.8
hxxps://195.2.252.86
hxxps://82.146.59.19
hxxps://185.80.128.16
hxxps://5.200.56.200
hxxps://95.213.252.23
hxxps://181.211.34.154:449
hxxps://187.191.0.42:449
hxxps://78.24.217.88
hxxps://82.146.58.196
hxxps://188.120.244.159
hxxps://95.213.251.95
hxxps://195.133.146.117
hxxps://156.17.92.161:449
hxxps://195.133.146.122
hxxps://78.24.222.226
hxxps://185.34.52.223
hxxps://195.133.147.74
hxxps://200.117.251.52:449
hxxps://62.109.1.68
hxxps://195.88.209.180

JUL 2020 Wk 2 

hxxps://197.232.50.85
hxxps://65.31.241.133:449
hxxps://188.68.211.126
hxxps://213.183.63.245
hxxps://94.232.20.113
hxxps://24.113.161.184:449
hxxps://64.203.225.216:449
hxxps://174.105.233.82:449
hxxps://188.68.208.240
hxxps://24.247.181.155:449
hxxps://190.145.74.84:449
hxxps://181.113.17.230:449
hxxps://140.190.54.187:449
hxxps://74.140.160.33:449
hxxps://64.128.175.37:449
hxxps://105.27.171.234:449
hxxps://72.189.124.41:449
hxxps://24.247.181.226:449
hxxps://71.14.129.8:449
hxxps://199.227.126.250:449
hxxps://46.149.182.112:449
hxxps://182.253.20.66:449
hxxps://213.32.122.246
hxxps://68.4.173.10
hxxps://206.130.141.255:449
hxxps://137.74.151.18
hxxps://24.227.222.4:449
hxxps://172.222.97.179:449
hxxps://216.183.62.43:449
hxxps://24.119.69.70:449
hxxps://103.110.91.118:449
hxxps://71.94.101.25
hxxps://47.49.168.50
hxxps://74.134.5.113:449
hxxps://174.105.235.178:449
hxxps://92.38.163.39
hxxps://42.115.91.177
hxxps://190.4.189.129
hxxps://46.72.175.17:449
hxxps://92.63.107.171
hxxps://208.75.117.70
hxxps://144.48.51.8
hxxps://109.86.227.152
hxxps://92.55.251.211:449
hxxps://46.47.50.44
hxxps://190.7.199.42
hxxps://78.155.199.51
hxxps://95.161.180.42:449
hxxps://185.174.173.18
hxxps://82.146.61.47
hxxps://94.103.82.87
hxxps://93.109.242.134
hxxps://209.121.142.202:449
hxxps://80.53.57.146
hxxps://185.129.78.167
hxxps://66.232.212.59
hxxps://46.243.179.212:449
hxxps://185.42.192.194:449
hxxps://107.144.49.162
hxxps://65.30.201.40
hxxps://85.143.216.250
hxxps://209.121.142.214:449
hxxps://185.168.185.218
hxxps://158.58.131.54
hxxps://94.112.52.197:449
hxxps://5.102.177.205:449
hxxps://86.125.39.173
hxxps://197.232.50.85
hxxps://65.31.241.133:449
hxxps://188.68.211.126
hxxps://213.183.63.245
hxxps://94.232.20.113
hxxps://24.113.161.184:449
hxxps://64.203.225.216:449
hxxps://174.105.233.82:449
hxxps://188.68.208.240
hxxps://24.247.181.155:449
hxxps://190.145.74.84:449
hxxps://181.113.17.230:449
hxxps://140.190.54.187:449
hxxps://74.140.160.33:449
hxxps://64.128.175.37:449
hxxps://105.27.171.234:449
hxxps://72.189.124.41:449
hxxps://24.247.181.226:449
hxxps://71.14.129.8:449
hxxps://199.227.126.250:449
hxxps://46.149.182.112:449
hxxps://182.253.20.66:449
hxxps://213.32.122.246
hxxps://68.4.173.10
hxxps://206.130.141.255:449
hxxps://137.74.151.18
hxxps://174.105.235.178:449
hxxps://172.222.97.179:449
hxxps://24.119.69.70:449
hxxps://216.183.62.43:449
hxxps://103.110.91.118:449
hxxps://71.94.101.25
hxxps://47.49.168.50
hxxps://74.134.5.113:449
hxxps://24.227.222.4:449
hxxps://92.38.163.39
hxxps://42.115.91.177
hxxps://185.143.172.110
hxxps://92.53.77.105
hxxps://178.78.202.189
hxxps://85.9.212.117
hxxps://118.200.151.113
hxxps://54.38.142.118
hxxps://194.68.23.182
hxxps://70.114.186.116
hxxps://138.34.32.218
hxxps://91.235.129.226
hxxps://184.68.167.42
hxxps://162.247.37.252
hxxps://200.46.121.130
hxxps://93.109.242.134
hxxps://77.89.86.93
hxxps://182.253.210.130:449
hxxps://83.167.164.81
hxxps://37.46.129.41
hxxps://95.213.200.239
hxxps://200.2.126.98
hxxps://109.234.35.87
hxxps://70.79.178.120:449
hxxps://158.58.131.54
hxxps://118.91.178.101
hxxps://89.117.107.13
hxxps://68.109.83.22
hxxps://109.86.227.152
hxxps://185.129.193.221
hxxps://190.4.189.129
hxxps://46.72.175.17:449
hxxps://144.48.51.8
hxxps://87.255.24.238:449
hxxps://109.86.227.152
hxxps://104.193.252.167
hxxps://95.161.180.42:449
hxxps://41.211.9.226
hxxps://85.172.38.59:449
hxxps://93.109.242.134
hxxps://209.121.142.202:449
hxxps://80.53.57.146
hxxps://185.42.192.194:449
hxxps://36.74.100.211:449
hxxps://66.232.212.59
hxxps://94.250.255.177
hxxps://182.253.210.130:449
hxxps://155.133.31.21:449
hxxps://200.111.167.227:449
hxxps://194.87.93.6
hxxps://65.30.201.40
hxxps://195.54.162.96
hxxps://209.121.142.214:449
hxxps://158.58.131.54
hxxps://188.124.167.132:449
hxxps://94.112.52.197:449
hxxps://185.180.198.37
hxxps://185.159.129.51
hxxps://5.102.177.205:449
hxxps://107.175.127.149
hxxps://68.111.123.100:449
hxxps://71.164.141.4:449
hxxps://198.46.198.241
hxxps://24.217.193.43:449
hxxps://68.119.85.138:449
hxxps://205.201.36.227:449
hxxps://24.217.192.131:449
hxxps://24.247.182.156:449
hxxps://107.174.34.202
hxxps://24.247.182.253:449
hxxps://97.87.175.152:449
hxxps://204.14.154.126:449
hxxps://73.2.223.45:449
hxxps://24.247.182.240:449
hxxps://107.146.147.235:449
hxxps://98.226.192.30:449
hxxps://24.247.182.167:449
hxxps://24.247.182.169:449
hxxps://24.217.49.92:449
hxxps://187.189.235.2:449
hxxps://108.174.60.161
hxxps://64.192.234.98:449
hxxps://108.174.120.172:449
hxxps://207.229.103.158:449
hxxps://24.113.169.148:449
hxxps://45.161.216.57:449
hxxps://185.252.144.21
hxxps://103.55.69.238:449
hxxps://209.191.203.238:449
hxxps://23.94.36.143
hxxps://192.3.52.107
hxxps://177.104.252.32:449
hxxps://190.109.178.222:449
hxxps://198.46.160.217
hxxps://24.35.1.6:449
hxxps://45.6.127.2:449

JUL 2020 Wk 1

hxxps://149.56.35.205
hxxps://93.95.97.20:449
hxxps://46.160.165.31
hxxps://93.99.68.140
hxxps://186.103.161.204
hxxps://191.7.30.30
hxxps://163.53.206.187
hxxps://147.135.185.124:449
hxxps://194.87.102.151:445
hxxps://193.124.117.102:449
hxxps://195.133.48.128:449
hxxps://191.7.30.30
hxxps://93.95.97.20:449
hxxps://93.99.68.140
hxxps://186.103.161.204
hxxps://149.56.35.205
hxxps://163.53.206.187
hxxps://193.124.117.102:449
hxxps://147.135.185.124:449
hxxps://194.87.102.151:445
hxxps://46.160.165.31
hxxps://195.133.48.128:449
hxxps://191.7.30.30
hxxps://195.133.48.128:449
hxxps://93.99.68.140
hxxps://46.160.165.31
hxxps://149.56.35.205
hxxps://186.103.161.204
hxxps://163.53.206.187
hxxps://147.135.185.124:449
hxxps://194.87.102.151:445
hxxps://193.124.117.102:449
hxxps://93.95.97.20:449
hxxps://149.56.35.205
hxxps://93.95.97.20:449
hxxps://46.160.165.31
hxxps://93.99.68.140
hxxps://194.87.102.151:445
hxxps://191.7.30.30
hxxps://163.53.206.187
hxxps://147.135.185.124:449
hxxps://186.103.161.204
hxxps://193.124.117.102:449
hxxps://195.133.48.128:449
hxxps://191.7.30.30
hxxps://195.133.48.128:449
hxxps://93.99.68.140
hxxps://46.160.165.31
hxxps://149.56.35.205
hxxps://186.103.161.204
hxxps://163.53.206.187
hxxps://147.135.185.124:449
hxxps://194.87.102.151:445
hxxps://193.124.117.102:449
hxxps://93.95.97.20:449
hxxps://195.62.53.213
hxxps://190.228.169.73
hxxps://194.87.99.155
hxxps://194.87.237.19
hxxps://89.231.13.33
hxxps://89.231.13.18
hxxps://197.248.210.150
hxxps://163.53.206.187
hxxps://46.160.165.16
hxxps://194.87.98.158
hxxps://195.28.183.87
hxxps://186.103.161.204
hxxps://118.91.178.134
hxxps://118.91.178.114
hxxps://94.42.91.27
hxxps://118.91.178.143
hxxps://89.231.13.27
hxxps://191.7.30.30
hxxps://195.2.252.178
hxxps://46.160.165.31
hxxps://94.140.121.180
hxxps://94.140.121.181
hxxps://195.2.252.252
hxxps://190.228.169.106
hxxps://118.91.178.121
hxxps://194.87.238.82
hxxps://149.56.35.205
hxxps://93.95.97.20:449
hxxps://46.160.165.31
hxxps://93.99.68.140
hxxps://194.87.102.151:445
hxxps://191.7.30.30
hxxps://163.53.206.187
hxxps://147.135.185.124:449
hxxps://186.103.161.204
hxxps://193.124.117.102:449
hxxps://195.133.48.128:449

APR 2020 Wk 2
"http://82.79.202.214:443"
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

 
Updated: 24 Dec 19

hxxp://203.176.135.102:8082
hxxp://112.78.164.34:8082
hxxp://103.94.122.254:8082
hxxp://170.238.117.187:8082
hxxp://190.100.16.210:8082
hxxp://190.119.180.226:8082
hxxp://96.9.77.142:80
hxxp://96.9.73.73:80
hxxp://36.89.106.69:80
hxxp://177.74.232.124:80
hxxp://103.84.238.3:80
hxxp://172.82.152.12:443
hxxp://198.23.252.135:443
hxxp://146.185.253.170:443
hxxp://64.44.51.124:443
hxxp://194.5.250.83:443
hxxp://66.55.71.128:443
hxxp://66.85.156.82:443
hxxp://146.185.253.131:443
hxxp://194.5.250.103:443
hxxp://194.5.250.107:443
hxxp://164.68.116.244:443
hxxp://93.95.97.44:443

Comments

Post a Comment

Popular posts from this blog

Grinju Downloader: Anti-analysis (on steroids) | Part 2

  This malware takes anti-analysis and stealth techniques to a new level We took a look at this malware in the Part 1 of this publication. Now let’s carry on with the analysis and dig deeper into the various anti-analysis and stealth-exec features of this malware in Part2. Malpedia Inventory: https://malpedia.caad.fkie.fraunhofer.de/details/vbs.grinju Secondary Macro Code First of all, here’s the entire code that is dumped in the sheet once all the macro functions have been completed. Take a look at these lines and try to figure out what they are meant to do. Then we’ll take a look at the most important of these briefly before moving on to the next section. =CLOSE(FALSE) =FORMULA(LEN(APP.MAXIMIZE())+-459,Sheet1!R18690C129) =FORMULA(LEN(GET.WINDOW(7))+-131,Sheet1!R18691C129) =FORMULA(LEN(GET.WINDOW(20))+-893,Sheet1!R18692C129) =FORMULA(LEN(GET.WINDOW(23)=3)+433,Sheet1!R18693C129) =FORMULA(LEN(GET.WORKSPACE(31))+864,Sheet1!R18694C129) =FORMULA(LEN(GET.WORKSPACE(13)>770)+707,Sheet1!R18
Post a Comment
Read more

Grinju Downloader: Anti-analysis (on steroids) | Part 1

  This malware takes anti-analysis and stealth techniques to a new level Malpedia Inventory: https://malpedia.caad.fkie.fraunhofer.de/details/vbs.grinju I’ve come across some great anti-analysis code in malware over the years. This one takes the top spot. On that note, let’s get into it, this is a long one! Since this malware employs a very complex structure, I’ve decided to divide the analysis into different sections. I’ll try to keep it as simple as possible but having said that, it really is a very complicated project. Hence, publishing in parts. TLDR: This is a very well-thought and equally well-written malware. There’s no VBA that you can analyse. The values and formulas that are used are spread across the worksheets to thousands of rows. The functions, among other things, are used to close the file, corrupt it and also delete the dropped scripts to make analysis extremely hard. In fact, you cannot analyse this malware without altering the code it self. Along the way, you’ll also
Post a Comment
Read more

TrickBot C2i and Configs March 2019

There are some new additions in the latest target list. These are the targeted URIs extracted from the complete configs. Some of the regex'd URIs are very interesting and highly effective. Article by  Vishal Thakur C2: http://103.119.144.250:8082 http://75.183.130.158:8082 http://96.36.253.146:8082 http://75.183.130.158:8082 http://96.36.253.146:8082 http://14.102.107.114:8082 http://181.115.156.218:80 http://200.21.51.30:80 http://36.91.93.114:80 http://97.87.127.198:80 http://190.152.125.162:80 http://192.210.152.173:443 http://212.80.216.228:443 http://185.68.93.59:443 http://31.202.132.5:443 http://107.175.132.141:443 http://185.86.148.195:443 Target list: <lm>https://us.etrade.com/webapiagg/aggregator</lm> <lm>https://us.etrade.com/etx/hw/0/accountshome.json</lm> <lm>https://www.nwolb.com/*.aspx*</lm> <lm>https://www.rbsdigital.com/*.aspx*</lm> <lm>https://www.ulsterbankanytimebanking.
Post a Comment
Read more