TrickBot trojan has added a module that uses the Masscan tool to look for open ports. Masscan is a mass TCP/IP port scanner, which can scan the entire internet in under five minutes according to its authors. The new module also contains a C2 communication function for connecting to the Anchor/Bazar attack framework, and a list of hardcoded IPs which have previously been associated with both IPs. TrickBot is a first-stage loader malware that has many variants, including malware families Kegtap, Singlemalt and Winekey.
Source: https://threatpost.com/trickbot-port-scanning-module/163615/