TrickBot uses a custom crypter leveraging Microsoft’s CryptoAPI to encrypt C2 traffic.Newer versions of TrickBot have been known to use bcrypt to encrypt and digitally sign responses to their C2 server. 