I am not entirely sure what the in initial binary download with this one is, but there are indications it might be Dark Comet RAT. What we do know is that it drops a Lokibot binary The word doc is actually a RTF file containing embedded ole objects. This appears to contain 5 identical ole objects that in turn drop an Excel macro enabled worksheet that when examined appears to be something to do with lottery numbers. I don’t know if this is some sort of red herring or someone in the masses of code ( which I have only … Continue reading →