Weaponization of Excel Add-Ins Part 2: Dridex Infection Chain Case Studies
Summary: Unit 42 observed Dridex and Agent Tesla samples in December 2021 abusing XLL files and Excel 4.0 (XLM) macros, with the XLM dropper reading ASCII values from one spreadsheet to build an HTA file that downloads Dridex from Discord URLs. Researchers extracted roughly 1,400 URLs from XLM and XLL files, found DLL payloads downloaded as MKV files and HTAs dropped as RTF, and noted the loader uses a micro VM with AddVectoredExceptionHandler to emulate call eax plus multiple API hashing functions.
Key Takeaway: Roughly 1,400 URLs were pulled from these XLM and XLL files, and the chain hides its stages behind legitimate services like Discord and OneDrive while disguising an HTA as an RTF and a DLL as an MKV - file-type assumptions your detection stack may still trust.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026