Zimperium zLabs cybersecurity experts: The malware, a trojan, has been used in an aggressive mobile premium services campaign against Android users in 70 countries.
The xls attachment contacts a single link and downloads the dll, which activates the malware infection. Provided that the IP is Italian and not on the blacklist.