I found a new dropper c580d77722d85238ed76689a17b0205b4d980c010bef9616b8611ffba21b142e with the same signature of others. But it changes the exploitation. Before, it uses the ole package to drop a 8.t file in %appdata% and decode two files, a legit file and an backdoor (PlugX, newcore rat, sysfader…). Now it’s a big object ole mapped in memory and one PE is used to drop the files. Now we have four object oles in the RTF. this RTF exploits again the CVE-2017_1882 on eqnedt32.exe.
