2020-07-08 - Trickbot gtag chil61 from XLS macros

2020-07-08 - COVID OR IRS-THEMED MALSPAM USING XLS SPREADSHEET MACROS TO PUSH TRICKBOT GTAG CHIL61

REFERENCES:

- https://twitter.com/abuse_ch/status/1280578303171100678
- https://twitter.com/abuse_ch/status/1280739909133836288

SHA256 HASHES AND FILE NAMES:

- NOTE: Creation dates for these XLS spreadsheets are all listed 2020-07-02:

- 141691c3e19b94306d6ccb96eb9ac7a147b23a091527256cc04a3303fdc6f50a  Base_COVID-19.xls
- 29d16f5611f3d08cf4df70807b7bc6b838667fe3f5258c61838719bd6d76c013  Form_coronavirus_Covid-19.xls
- 451aae69a290dcb371bb8159409e21b54c620e83c1d67369794ebb958a194584  Base_covid-19.xls
- 771bc37ae06f0bdc092f28507f1c629bb9e976065367de20d6f96a70bd174e44  Base_covid-19.xls
- 7baa34e9a6a8234ce47c0ac65f9e661ada3e317c49038678ffb2e215f7818e6c  Base_Covid-19.xls

- 07fb7deeb15f98d0058330eb6e7d46ca5a97abfc0f5c3b2833ed8819a783aa76  Sheet_2920834.xls
- 08f2383668a39e569a49a6eea5c09535f0fd173efafce0ed67bc1973b2314267  IRS_1243383.xls
- 0acdccba3b7aaa3b0f4398f207d5ed0329ce6556a7f0ca20737d7bc12d2724c3  IRS_Sheet_5996749.xls
- a5ff0973010a5f0e4878f9da26aed03c8f00ce4bba85bdc050fa237165679c29  Tax_1834635.xls
- 29ae5f27132ea8a5225a3d94d045986c6069d57414d5b5e5d59c0e9a4fdd9f01  W2_tax.xls
- 2cd576973649096b2fc516e4a38e795a97f7badfda1f79b5936960eaf8975df9  IRS_Sheet_5994371.xls
- 472732e4e8185056bd820d40fbab6be8f310a0d86c97c635968808b7da210776  IRS_4681393.xls
- 4771bbb1ebb2db87838b8d27bbd94ee2819fc3ceb0d6c32967b5d10b8597c8eb  W2_form.xls
- 7297cd4dfb810c66bee44849701c697405e3fd64adee1989dcb66789ffba7e35  IRS_Tax_5522181.xls
- 7ade4c43fe95e92dca2d081b3e9ddc8117e829560c8c5803c38858ae5a8d4903  Form_1099_5831674.xls
- 483891856f43df63a885ff3291dd956e8070a68077890f2ab279699c61183cd6  W2_form.xls
- 75deb4ec4bfda2b44eb5afffc5f4bbddb1e2ed6ba90148567a57fef2a8b12080  Form_1099_6696386.xls
- 8545b15f9227fff6626fec6fa558eef03e8aa2aa5dc8f59f19ca1b9ae02f0db2  IRS_Page_5942590.xls
- 9126bcdd63ff19638c4505848f22c4776b7475db794c9c472010cfa7302b399d  IRS_form_5582265.xls
- 9f7a749a729208a968eff0ae2534b0500862b053ac685356ddef06a0265674ed  W2_tax.xls
- a5ff0973010a5f0e4878f9da26aed03c8f00ce4bba85bdc050fa237165679c29  Tax_1834635.xls
- b13fc4d81152548748887b9efe6dd5a20421042a3b65f4a387109be177620e5c  Form_1099_4413039.xls
- b70d3518a8ad2e5e49b874642012d80ff9570a52541290510a60fc06d2439ffd  W2_sheets.xls
- c158c7dcd08b2369ef3eb1f782a9cb9bd9d0b63895854d9e543dcb61add33158  IRS_form_1633293.xls
- c34abd7230748b5d70d0b2565dd2ffbfc7f23a5f4d95f489258b660f5b28797f  Form_1099_8850408.xls
- ccbdae077993172c7240b02e5685db8a2e638822332fe20c8608d1690c220909  Tax_7280780.xls
- d3fe0fb29b7bc79908ff52b288d5298a2e2465842e3b1a17a5d8ab2a351efaa2  Tax_70448494850062.xls
- d62c3ac2168b4ab031ae995537a3d47f5bc4d575bbfc56c4207d069e3db038d2  IRS_5388812.xls
- e596e24a08607b4dbfa6b395b546caa6f316921a0088d56354c9734599b73397  Form_1099_3532210.xls