Trusted Design

Dyre Botnet Using Malicious Microsoft Word Macros

概要

The Dyre group, a major malware spam producer, has changed their initial malware dropper to utilize Microsoft Word document macros instead of the usual executable types, such as .exe files contained in a .zip.

Created: 2026-02-23

Indicators

• URL - https://109.236.83.205/action.php?get_letter -
• URL - http://184.164.97.60/erwtwgw.exe -
• URL - http://67.219.169.161/wheel11.png -
• URL - http://pilsudskiego175.pl/modules/mod_araticlws -
• URL - http://69.9.204.16/wheel11.png -
• URL - http://ezzylab.com/content-el/6612536153.txt -
• URL - http://69.8.48.175/wheel11.png -
• URL - http://173.248.22.227/wheel11.png -
• URL - http://216.245.211.242/wheel11.png -
• URL - https://109.236.83.205/action.php?action=get_mails -
• URL - http://pilsudskiego175.pl/modules/mod_araticlws/ -
• URL - http://67.206.97.238/wheel11.png -
• URL - http://209.193.86.41/erwtwgw.exe -
• URL - http://69.9.204.31/wheel11.png -
• URL - http://38.124.72.230/wheel11.png -
• URL - http://38.124.111.30/wheel11.png -
• URL - http://69.9.204.36/wheel11.png -
• URL - http://ezzylab.com/content-el/lns.txt -
• URL - http://208.80.80.111/wheel11.png -
• FileHash-MD5 - 6162c6b0abc8cab50b9d7c55d71e08fe -
• URL - http://67.206.96.30/wheel11.png -
• FileHash-MD5 - 512b7bac1ce4cf63dd9bb6dbe7f16f20 -
• URL - https://109.236.83.205/action.php?get_sender -
• URL - http://69.9.204.114/wheel11.png -
• FileHash-MD5 - 20357c95962d1cda36eeb7386ea31aea -
• URL - http://73.175.203.173/wheel11.png -

類似Pulses

• Enterprises Hit by BARTALEX Macro Malware (score: 0.73)
• Evoltin POS Malware Attacks via Macro (score: 0.69)
• Dyre Malware Campaigners Innovate with Distribution Techniques (score: 0.68)
• Malware delivered via Necurs botnet by DDE feature in Microsoft Word (score: 0.66)
• The KeyBoys are back in town (score: 0.65)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る