The xlsb mail attachment contacts a url and downloads the malware from an opendir, which also contains Ursnif/Gozi and is constantly updated.
Hayat Tahrir al-Sham (HTS) seeks to raise cash on Idlib population by doubling shop rents
Hayat Tahrir al-Sham (HTS) tries to raise money on the population in Idlib. In recent days, members of the Al-Ghana’em Committee and the “economic office” of HTS have carried out inspections of shops in the city of the northern Syrian province. On the occasion, they communicated to the managers that rents will increase from February. There is talk of almost a doubling, with figures that from 250 dollars a month have reached 400. The one on the shops, once belonging to supporters of Damascus or members of persons connected to the army (SAA) and then seixed by jihadists near the Qeada and Turkey’s allies, are only the latest in recent taxes imposed locally. Moreover, it adds to the skyrocketing prices (which will still rise due to the increase in rents) and the lack of fuel, most of which is seized by militiamen for “security” reasons.
The Qaedist group must recover funds to maintain defenses and pay wages to the fighters. Especially after Turkey cut aid, while Russia and SAA increased pressure
The new taxes imposed by HTS in Idlib have a clear meaning. The jihadist group is short of resources. On the one hand, Turkey, its main ally, has reduced aid and attention as it is preparing an offensive against Kurdistan. On the other hand, Russia has increased targeted raids especially along the M4 and the SAA closely threatens Barah with continuous attacks. Furthermore, the Qaedists have grown rapidly in the last year with the annexations of other (not always voluntary) formations. As a result, they need more funds to keep the defenses operational and pay the fighters’ wages. Otherwise, the risk is mass defections, which would translate into greater permeability towards the Syrian army offensive. However, the policy of heavy taxes feeds popular protests. These have so far been repressed, but discontent grows. Furthermore, cases of espionage in favor of Damascus will multiply.