Molerats__2019__suspected-molerats-new-attack-in-the-middle-east-cn.pdf

360 Threat Intelligence Center analyzed a Molerats-attributed targeted campaign that delivered a backdoor via Arabic-language Word documents containing malicious VBA macros which drop and run an Enigma Virtual Box–packed payload (ihelp.exe); the report includes static and dynamic analysis, network protocol details (SFML-based HTTP POST), C2 information (smartweb9.com and associated IPs), sample hashes, keyword-based command protocol, sinkhole evidence for the C2, and recommended mitigations.