We’ve got ourselves a change to the zloader XLM code and also some document behavior. Here’s today’s sample:
https://app.any.run/tasks/79dcccc4-b38a-4831-a9d5-b11a987e9729
URLs:
s://chuguadventures.co.tz/wp-touch.php
s://cirabelcr6dito.com/wp-touch.php
s://digitalseven.net.co/wp-touch.php
s://dortome.net/wp-touch.php
Central Loop Mechanism
The decoding part of the central loop mechanism still exists as it did before. It grabs hex characters from elsewhere in the document, decodes them, and writes those strings to new cells. However in this case, the document only runs through two rounds of this decoding.
Round 1
The first round behaves pretty much the same as it did before. It checks to see if it’s in a sandbox, checks the registry, and if VBAWarnings is turned on, the code will go back to the loop and start round 2.
Round 2
This is where the main difference lies. A series of lines get written to a file called QP0L3.vbs and then executed.
QP0L3.vbs
The code in the .vbs file is nothing that special. It’s just an array of URLs going through a For Each loop. The file gets downloaded and then saved as an .html to the Temp folder.
Back to Round 2
At this point, the .html file is executed with what looks to be rundll32.exe.
And that’s pretty much it! Again, not a major change, but I thought it was a noteworthy one.
Thanks for reading!
Article Link: https://clickallthethings.wordpress.com/2020/09/21/zloader-xlm-update-macro-code-and-behavior-change/