Malicious RTF Documents Spreading Malware

Malicious RTF documents embed multiple Excel OLE objects and use the \objupdate control to force repeated macro prompts and execution; embedded VBA runs PowerShell to drop a VBS (svchost32.vbs) which downloads and executes svchost.exe, resulting in NetWiredRC and Quasar RAT infections. The macro also modifies registry keys to permanently enable Office macros. The report includes deobfuscated macro/VBS/PowerShell details, infection flow, and IOCs (MD5 hashes, download URLs, C2 domains/IPs) tracked by Zscaler ThreatLabZ.