The xlsb mail attachment contacts a url and downloads the malware from an opendir, which also contains Ursnif/Gozi and is constantly updated.
The SDF return to Deir Ezzor to launch a new Cizire Storm operation against Isis at south and east of the province
The SDF in Syria are converging on Deir Ezzor to launch another operation against Daesh following the example of Cizire Storm (Al Jazeera). The Kurdish forces, after having fought the Turkish troops of Olive Branch at Afrin, have started to assemble and converge towards the province. The objective is to chase the Islamic State out of the southern area (right up to the border with Iraq) and the north eastern area, in the Middle Euphrates Valley (MERV). This is because Isis is growing in the area and is becoming more and more active, in what they called Al-Furat Wilayat. The militiamen have resumed holding sermons in public, executing opponents and civilians who had rebelled, as well as alleged traitors who had worked for the enemy. The army of Damascus (SAA), as a matter of fact, has not succeeded in eliminating jihadists at Abu Kamal (Al Bukamal), but has only just presided the areas which had already been conquered, avoiding to advance.
Meanwhile, the International Coalition bombards Abu Kamal and Inherent Resolve denies an alleged attack at Ayn Issa
To confirm that something is moving at Deir Ezzor there is also an increase of the International Coalition raids against the Daesh stations in the province. From 33 to 29 march there have been 11 air raids against the Islamic State, out of which 4 in Iraq and 7 in Syria. All the actions, moreover, were concentrated around Abu Kamal. This, supposedly, in view of the beginning of the new operation of the SDF. In the meantime, the operation Inherent Resolve has firmly denied the alleged attack of the pro-Assad militias against the base of Ayn Issa. Some media sources had reported the news that the Militia of the Syrian Resistance of Raqqa had fired mortar shells. against the structure, causing victims. Colonel Ryan Dillon, spokesman of the mission has explicitly written on his Twitter profile that the indiscretion is “false and trash”.