The vmtools.dll file is a modified DLL that both ensures persistence and loads MSBuild.exe, which is the BADNEWS malware renamed to spoof a legitimate Microsoft Visual Studio tool. A number of commands are provided to the attackers, including the ability to download and execute additional information, upload documents of interest, and take screenshots of the desktop. This malware family used the new mutex ‘com_mycompany_apps_appname_new’. This variant of BADNEWS uses different filenames compared to previous versions. All of these files reside in the victim’s %TEMP% directory: Other changes we noticed in this variant include how the malware obfuscates C2 information stored via dead drop resolvers. BADNEWS performs many of the expected functions associated with previous versions including keylogging and identifying files of interest. Unlike a previously reported variant, this version of BADNEWS no longer looks at USB drives for interesting files. It continues to seek out files with the following extensions: In order to prepare for C2 communication, BADNEWS will aggregate various victim information, which is appended to two strings. C2 communication is also updated from prior versions, with the following commands now supported by BADNEWS: During C2 communications, BADNEWS will communicate to the C2 previously identified via HTTP. Through the use of relatively new exploits, as well as a constantly evolving malware toolset, they aim to compromise prominent organizations and individuals to further their goals. One of the malware families tied to this group, BADNEWS, continues to be updated both in how it uses dead drop resolvers, as well as how it communicates with a remote C2 server