LNK Malware Leverages Legit Windows Files to Slip Past Defenses

In a recently observed campaign emerging from Israel, threat actors have revived the use of Windows shortcut (.LNK) files to deliver a potent Remote Access Trojan (RAT).

These seemingly innocuous shortcut files exploit Living-off-the-Land Binaries (LOLBins) such as odbcconf.exe to silently register and execute malicious DLLs, evading security tools and complicating detection efforts.

The attack begins when victims are lured into downloading a file named “cyber security.lnk” from a Discord channel. Upon clicking, the shortcut opens a decoy PDF titled “Cyber Security.pdf” to distract the user, while a hidden PowerShell sequence executes in the background.

To avoid any visible console windows, the script launches conhost.exe in headless mode, dynamically resolves the path to PowerShell, and runs it with no window.

Next, the PowerShell script creates a working directory under C:\Users\Public\Nuget and defines several variables:

• Moq.zip: the malicious archive.
• Cyber security.pdf: the decoy.
• Cyber security.lnk: the malicious shortcut.
• $ENV:Temp and $env:PUBLIC: for file staging.

The raw LNK bytes are scanned for the %PDF magic header, allowing extraction of the embedded decoy PDF.

The LNK file is deleted to cover tracks, and the ZIP archive is extracted into the Nuget folder. After a brief delay, Moq.dll and supporting libraries (Dapper.dll, Newtonsoft.dll, and a file named Nunit) emerge, while the ZIP is removed to maintain stealth.

DLL Execution and Core RAT

To activate the RAT without triggering alarms, the script abuses odbcconf.exe, a legitimate Windows binary, using the command:

textodbcconf.exe /a {regsvr "C:\Users\Public\Nuget\moq.dll"}

This registers and executes Moq.dll as a COM DLL, invoking its DllRegisterServer export. Instead of embedding all payload logic, Moq.dll dynamically loads Dapper.dll and Newtonsoft.dll, increasing complexity for reverse engineers.

During dynamic analysis, Moq.dll was observed to:

• Load amsi.dll and patch AmsiScanBuffer to always return failure, bypassing the Anti-Malware Scan Interface.
• Patch EtwEventWrite in ntdll.dll to disable Windows Event Tracing, thwarting security logging.
• Invoke WideCharToMultiByte to process the “Nunit” payload, which is decoded and passed to Dapper.dll’s NowYouCanSeeME() function.
• Use CLRCreateInstance to host the .NET runtime and execute the decoded PowerShell script.

The resulting PowerShell script, once deobfuscated, reveals AES-encrypted modules that the RAT decrypts at runtime, storing the plaintext in a variable for execution. For safety, analysts redirected this output to a file rather than running it.

Following execution, the malware ensures persistence by modifying the registry key

textHKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

to append its launch command alongside explorer.exe, guaranteeing activation on login.

The RAT generates or reads a unique Bot ID and machine identifier from files in the Temp directory before reaching out to a hard-coded C2 URL (e.g., hotchichenfly.info).

If the primary server is unreachable, it computes a fallback address based on the Bot ID and username. Commands from the C2 are base64-encoded and stored in temporary files, then decoded and executed as needed.

Key RAT capabilities include:

• Collecting system metrics such as antivirus products, OS details, IP address, and username.
• Capturing screenshots, encoding them in base64, and exfiltrating them to a remote server.
• Uploading arbitrary files via the Dropbox API using stolen tokens.
• Entering a perpetual loop to fetch and execute new C2 commands.

This comprehensive feature set underscores the RAT’s versatility as a multi-functional espionage tool.

Mitigations

Security teams should implement the following defensive measures:

• Block or closely monitor the execution of LOLBins such as odbcconf.exe for non-standard parameters.
• Enforce application whitelisting to prevent unknown DLL registrations.
• Enable and protect AMSI and ETW logging to detect in-memory patching attempts.
• Educate users about the risks of opening shortcuts and downloading files from untrusted chat platforms.

Given the sophistication of this LNK-based RAT and its use of legitimate Windows components, deploying a reputable security solution—such as K7 Total Security—and ensuring signatures, heuristics, and behavioral detections are up to date is crucial to thwarting future attacks. Continuous patching, strict privilege separation, and vigilant monitoring of abnormal process executions remain essential to maintaining a secure posture.

IOC’s

Hash	Detection Name
7391C3D895246DBD5D26BF70F1D8CBAD	Trojan ( 0001140e1)
2956ec73ec77757271e612b81ca122c4	Trojan ( 0001140e1)
5a1d0e023f696d094d6f7b25f459391f	Trojan ( 0001140e1)
92fc7724688108d3ad841f3d2ce19dc7	Trojan (0001140e1 )

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.