Medre.A is a an AutoCAD worm, written in AutoLISP and is a very unusual piece of malware. It was
ACAD/Medre.A – 10000′s of AutoCAD files leaked in suspected industrial espionage and the corresponding whitepaper ACAD/Medre.A and ESET technical analysis is here ACAD/Medre.A Technical Analysis
ESET reported Peru and neighboring countries as the target but I noticed that one of the samples' (MD5 25c7e10bb537b4265f6144f2cd7f6d95) original name is 未命名1 ( Unnamed 1), so I wonder if some targets/sources were Chinese speaking.
P.S. The samples were donated by an anonymous but the original source is someone from Malwarebytes forum and I want to thank him/her (sorry don't know the name) for sharing. I hope they do not mind me posting them here.
