      Figure 3. An example of a coronavirus-related spear-phishing email attachment     Once the victim downloads the malicious macro, it will decrypt an embedded executable dropper that is hidden inside a text box, which will then be saved to a hardcoded path prior to it executing in the machine.      Figure 4. Malicious macro that decrypts an executable hidden inside a text box      Figure 5. Examples of encrypted Crimson RAT executables hidden inside text boxes     Once the executable file is executed, it will proceed to unzip a file named mdkhm.zip and then execute a Crimson RAT executable named dlrarhsiva.exe.