Updated 2025-01-10-IOCs-for-CVE-2017-0199-XLS-infection-chain.txt

PaloAltoNetworks · Jan 10, 2025 · f1e057a · f1e057a
1 parent 93eef3b
commit f1e057a
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/2025-01-10-IOCs-for-CVE-2017-0199-XLS-infection-chain.txt b/2025-01-10-IOCs-for-CVE-2017-0199-XLS-infection-chain.txt
@@ -4,6 +4,11 @@ AUTHORS:
 
 - Vishwa Thothathri, Bradley Duncan
 
+REFERENCES:
+
+- https://www.linkedin.com/posts/unit42_steganography-dbatloader-guloader-ugcPost-7283569822586564608-2n2Y/
+- https://x.com/Unit42_Intel/status/1877804202853838922
+
 INFECTION CHAIN:
 
 - presumably through email --> CVE-2017-0199 Excel file --> HTA --> VBS --> JPG with embedded info --> DBatLoader/GuLoader style malware --> AgentTelsa-style FTP data exfiltration