Another Potential MuddyWater Campaign uses Powershell-based PRB-Backdoor - TrendLabs Security Intelligence Blog

Trend Micro analyzed a targeted email lure using a macro-enabled Word document that decodes embedded PowerShell code to install a PRB-Backdoor (linked to the MuddyWater actor). The malware communicates with a C2 at out100k.net, supports data theft (browser history/passwords), remote command execution, persistence, and includes distinct dropped components and an SHA256 indicator.