XLL malware distributed through mail
released on 2022-05-23 @ 03:29:14 PM
XLL files that can be operated with the .xll extension are additional function files of Microsoft Excel (Excel) and can be executed through the corresponding MS Excel. The peculiar thing is that it can be misunderstood that the document is executed as MS Excel, but this XLL file is in the form of a DLL executable file. In the case of Excel files (.xlam, .xlsm) containing VBA macros introduced a lot in the past, they are produced in VBA, but in this case, they are produced in C language series. Therefore, the appearance of DLL remains the same, but the detailed internal configuration may differ depending on the compiled case.
In Korea, it has been confirmed that it has been circulating continuously since July last year. At this time, it is confirmed that the types of malicious codes that are distributed through e-mail and finally executed are various such as infostealer and ransomware.