IQ-FA002: Dridex XLSM Documents using 4.0 Macrosheets

Posted on 2020-05-11 by William MacArthur

Dridex XLSM Documents using 4.0 Macrosheets and bypassing vendors today.

The XLSM 4.0 Macrosheets technique can be further reviewed from our blog post from last week:: ZLoader 4.0 Macrosheets Evolution


Date Observed Indicator Type Indicator                                                         Notes
5/11/2020     XLSM Document   ba6d52ced38594fd44ba6beb0bd50e5d83319b7a435958ed4c7dc33770561abd Dridex,4.0 Macrosheets
5/11/2020     Domain   A record
5/11/2020     Registrant    Robin Crume   No other domain names associated (yet)
5/11/2020     IP AS45102 CN CNNIC-ALIBABA-US-NET
5/11/2020     Binary        4fae283ae2323e49f1a95871e773e3a2bfe54dc151cd7c11cbe41a36fd83bb14 One of many Binaries from this run