Some further TTPs used by TRICKBOT [1] from an infected host that I thought was interesting to share. The sample used here is from an EMOTET to TRICKBOT infection "GTAG:mor14" courtesy of Malware-Traffic-Analysis. 👏👏 Samples Used * C:\Users\AUSER\AppData\Roaming\netcloud\բնութագրվում է.exe * C:\Users\AUSER\AppData\Roaming\