Malware Campaigns Targeting African Banking Sector

INDICATORS OF COMPROMISE
HTML file:
9af5400545853d895f82b0259a7dafd0a9c1465c374b0925cc83f14dd29b29c5

ISO file:
7079ff76eb4b9d891fd04159008c477f6c7b10357b5bba52907c2eb0645887aa

VBS script:
43aaa7f39e9bb4039f70daf61d84b4cde2b3273112f9d022242f841a4829da03

PowerShell script:
0407eab084e910bdd6368f73b75ba2e951e3b545d0c9477e6971ffe6a52a273a

Encrypted GuLoader shellcode:
d681b39362fae43843b1c6058c0aa8199673052507e5c500b7361c935037e05e

RemcosRAT Payload URLs:
hxxps://onedrive.live[.]com/download?cid=50D26408C26A8B34&resid=50D26408C26A8B34%21114&authkey=AGW61DvT-RT_FRU
hxxps://www.dropbox[.]com/s/veqimnoofpaqmx1/rmss_umUIGF84.bin?dl=1

Encrypted RemcosRAT payload:
5d45422cf2c38af734cee5a5c9fa2fef005f9409d5d5b74814aea1a5f246835d

TYPOSQUATTED DOMAINS
The following domains were typosquatted by the threat actor to impersonate a credible and legitimate organization and do not represent a vulnerability affecting the organization.

Typosquatted domain 1	afbd-bad[.]org
Typosquatted domain 2	afdb-bad[.]org
Typosquatted domain 3	afdb-za[.]org