TrickBot: Ono! New Tricks!

The report analyzes a TrickBot 'onoXX' campaign that uses hashbusting .php loaders, shifts toward fileless module loading on Windows 10, and, instead of typical ransomware follow-up, drops an XMR cryptominer via self-extracting RAR payloads. The authors provide runtime behavior, persistence mechanisms, script and binary filenames, MD5/SHA-like hashes, extracted miner configuration, and actionable IOCs to aid detection and incident response.