###### The SFX archive executes for get system informations and the architecture in using the function GetNativeSystemInfo and Getsysteminfo who are using for know the good parameters for the SFX installer.
###### Once this done, this show a fake window of Word in using riche020.dll method. Define the language of thread in Russian.The execution of the code is do in another thread who run the malicious parts in the background.
###### Its create the vbs and ps1 file by redirection of the console output, a schedule task as persistence and execute the files.
###### We can see on the obfuscated strings, that some patterns have been generated and randomized by a DOS obfuscate tool. The vbs file check the version of Word and disable some security features. The powershell file send the reconnaissance informations on the C2.
###### Like observed with muddywater, this repeats until the group edit a URL with the next payload if the target is interesting.
### Final PE <a name="PE"></a>
###### This check the connectivity to internet by requesting the DNS of Google and use the shellscript.exe for try to download by the edited URL.
###### This PE file uses the OpenSSL, SMTP, FTP and various algorithms libraries in C, this a compiled version of Wget.
###### This version of Wget is used on many campaigns of this group since 2017.
