Previous related research: https://sec0wn.blogspot.com/2018/05/clearing-muddywater-analysis-of-new.html?m=1 https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/ https://blog.malwarebytes.com/threat-analysis/2017/09/elaborate-scripting-fu-used-in-espionage-attack-against-saudi-arabia-government_entity/ https://www.sekoia.fr/blog/falling-on-muddywater/  Decoy images by country Jordan     The Hashemite Kingdom of Jordan, Ministry of Justice (mwjo.doc) DAMAMAX.doc    Turkey     Turkey’s General Directorate of Security Turkey’s Directorate General of Coastal Safety        Turkey’s General Directorate of Security (Onemli Rapor.doc) Turkey’s Ministry of the Interior (Early election.doc)    Saudi Arabia Document signed by the Major General Pilot, commander of the Saudi Royal Air Force     KSA King Saud University (KSU) KSA King Saud University (KSU)    Azerbaijan İnkişaf üçün görüş.doc (meeting for development) Iraq     Iraqi Ministry of Foreign Affairs Government of Iraq, the Treasury of the Council of Ministers    Pakistan     ECP.doc National Assembly of Pakistan.doc        P.Police.doc     Afghanistan President.doc, E-government of Afghanistan Technical details Below is a description of the malware extraction and execution flow, starting from the initial infection vector, running VBA code via a macro and then dropping the PowerShell code that establishes command-center communications, sends victim system information and then receives commands supported by the malware