A zip attachment contains a img with an exe: the malware. The other, a pdf downloading a zip with an exe: the same malware. The data is exfiltrated via SMTP.
Syria, HTS launches internal purges in Idlib against rival militias

HTS launches an internal purge campaign in Idlib against rival militias. A former member of Hurras al-Din and the Hananu Brigade of the al-Sham Corps arrested. The pro-Turkey group fears coups with increased SAA-Russia pressure
Hayat Tahrir al-Sham (HTS) has launched a campaign of targeted arrests of “disturbing” elements in Idlib. They are representatives of other militias or independents, which represent a danger in the immediate future for the pro-Turkey group. In the past few hours, a former member of Huras al-Din, who now operates independently, was captured in Salqeen. On August 27, however, HTS arrested the military commander of the Hananu Brigade of the al-Sham Corps and his bodyguard in Kafr Takharim. There is no news on the fate of the prisoners. According to local sources, the Qaedist formation fears that the increase in pressure by the Syrian army (SAA) and Russia could lead to attempted coups from rival factions in the province. Above all, since Ankara has now reduced the aid sent to the bone and the population is increasingly nervous.