# TrickBot masrv Module: Masscan-based Network Scanner with Anchor/Bazar Infrastructure Overlap > Kryptos Logic analyzed 'masrv', a TrickBot module that embeds the open-source Masscan port scanner. It pulls IP ranges, port ranges and scan rate from C2 over HTTP and posts discovered open ports back, giving operators internal-network reconnaissance. The sample was compiled 2020-12-04 and had not been observed in the wild at time of reporting. - **Published:** 2026-10-17T17:39:04Z - **Last reviewed:** 2026-10-17T17:39:04Z - **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3827 - **ID:** TL-2026-3827 - **Severity:** HIGH - **Category:** MALWARE - **Status:** MONITORING - **Actor:** TrickBot operators - **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier) ## Description masrv is a network reconnaissance module for the TrickBot modular trojan, delivered as a 32-bit or 64-bit DLL (the analyzed samples are debug builds) exporting two functions, Start and Control. The module embeds Masscan and uses Masscan's own packet-level TCP/IP stack, which requires the NPcap driver (NPcap\Packet.dll). If NPcap is absent, masrv downloads an installer named npcap.exe from the C2 and runs it via CreateProcessA or ShellExecuteExA. C2 communication is plain HTTP using URIs of the form http://:///mass/, where gtag is the campaign ID from the bot config and botID identifies the victim. At startup the module issues GET requests for the commands 'freq' (reporting frequency), 'domains' (despite the name, the IP and port ranges to scan) and 'rate' (packet transmission rate), and can fetch 'npcap.exe'. Discovered open ports are aggregated and POSTed to the C2 with command '81' at the interval set by 'freq'; a 'over' GET signals scan completion. For adapter selection the module reads the ARP table and local IP table (GetIpNetTable, GetIpAddrTable) and verifies connectivity with 'ping 8.8.8.8 -S '. The module carries an unreferenced Anchor C2 communication function and a hardcoded list of IP addresses previously associated with Anchor and Bazar infrastructure, consistent with TrickBot developers' practice of sharing code across toolsets. Debug strings and PDB paths (D:\Project\masrv\build-masrv\debug\Desktop_msvc_15_0_32bit|64bit\masrv.pdb) show it was built from a Qt/MSVC 2017 project. Kryptos Logic dates the compilation to 2020-12-04 and reported the module had not yet been seen deployed, suggesting testing or early development after the October 2020 Microsoft-led disruption of TrickBot. Secondary reporting (Security Affairs) assesses that the scan results would help operators plan lateral movement; this is analyst inference rather than observed behavior. Defenders should treat the module as a precursor to internal reconnaissance: high-rate SYN scanning from a single workstation, an NPcap installation not initiated by an administrator, and HTTP requests with a /mass/ path segment to non-corporate hosts are the main observable behaviors. ## MITRE ATT&CK - T1595.001 Scanning IP Blocks - T1046 Network Service Discovery - T1018 Remote System Discovery - T1071.001 Web Protocols - T1106 Native API ## Sources - [TrickBot masrv Module (Kryptos Logic)](https://www.kryptoslogic.com/blog/2021/02/trickbot-masrv-module/) - [TrickBot Continues Resurgence with Port-Scanning Module (Threatpost)](https://threatpost.com/trickbot-port-scanning-module/163615/) - [Experts discovered a new Trickbot module used for lateral movement (Security Affairs)](https://securityaffairs.com/114103/malware/trickbot-new-module.html) - [TrickBot Port-Scanning Module (G5 Cyber Security)](https://blog.g5cybersecurity.com/trickbot-port-scanning-module/) - [Masscan: Mass IP port scanner (upstream open-source project)](https://github.com/robertdavidgraham/masscan) ## Full data Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp Canonical: https://intel.threadlinqs.com/threat/TL-2026-3827