Brushaloader gaining new layers like a pro

This report analyzes a 2019 Polish-targeted malspam campaign that used a malicious XLS document as a first-stage dropper to deliver Brushaloader, which then deployed an ISFB v2 banking trojan. The author walks through macro extraction, PowerShell deobfuscation, C2 interaction that returns an XOR-encrypted VBScript dropper, and the static config used to download webinjects and redirects for Polish banks and email providers; sample hashes and helper scripts are provided.