Molerats__2019__suspected-molerats-new-attack-in-the-middle-east-en.pdf

360 Threat Intelligence Center analyzed a targeted campaign suspected to be carried out by the Molerats APT: an Arabic Word document with malicious VBA macros drops a Base64-decoded VBS and an Enigma Virtual Box–packed backdoor (ihelp.exe) that contacts C2 (smartweb9.com) using SFML-based HTTP POSTs, supports remote shell and file operations, uses keyword-based encoded payload blocks, and whose C2 was subsequently sinkholed; the report includes IoCs (file hashes, domains, IPs), behavioral analysis, and contextual attribution to Molerats.