Vulnerabilitymedium
Following the LNK metadata trail
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 88.198.148.231 | owershell code to download and execute a binary from hxxp://88.198.148[.]231/u.exe. According to VT information, this sample with hash |
| sha256 | 1b2ed05f488f8439688a02cc6ef84f939d16169117b489219b688a3ea482e5ed | 4411983001d29236c5d3fb4ff26f01b5742badca1db8d49264c01ba506c 1b2ed05f488f8439688a02cc6ef84f939d16169117b489219b688a3ea482e5ed 6ce64dedbe81c36aef38fd2d567f6ab9737df708591dc2f0cafa56db26a |
| sha256 | 1e0b92485e09ac970ae38214fb5c7407f73027ada47ea697017e49cacb576908 | dedbe81c36aef38fd2d567f6ab9737df708591dc2f0cafa56db26a1d043 1e0b92485e09ac970ae38214fb5c7407f73027ada47ea697017e49cacb576908 The samples had very few or no detections at all in VT, eve |
| sha256 | 2738ee3f181994cca5d9ea19359b8142981583d17563934ab3212eefe13af3ff | es sharing the same metadata Just as an example, the sample 2738ee3f181994cca5d9ea19359b8142981583d17563934ab3212eefe13af3ff in Figure 12 leads to a Bumblebee DLL . Conclusion In the c |
| sha256 | 2f9da7145056a4217552a5a536ceb8365e853fbd04d28ae2d494afb20e9c021f | 4f91e27afec5c1b1f71d708775c9b6e2af31e8331bbf26751bc0583dc7e 2f9da7145056a4217552a5a536ceb8365e853fbd04d28ae2d494afb20e9c021f 52458b4aaddbcb04048be963ea7d669c2ff7a69642d027f88812a5c6c1a |
| sha256 | 3cca8d1b4cfe0ebcf105621700454d0285ef1b44dfed3e3abf70060bb62aa5b4 | Figure 11 leads to a Bumblebee DLL while other hashes like 3cca8d1b4cfe0ebcf105621700454d0285ef1b44dfed3e3abf70060bb62aa5b4 lead to an IcedID DLL . In both cases the same username is |
| sha256 | 52458b4aaddbcb04048be963ea7d669c2ff7a69642d027f88812a5c6c1ade955 | 7145056a4217552a5a536ceb8365e853fbd04d28ae2d494afb20e9c021f 52458b4aaddbcb04048be963ea7d669c2ff7a69642d027f88812a5c6c1ade955 6a980d7659efb8bfb997dec3259d6eb090d4e6a4609e4c0666e04ad6121 |
| sha256 | 54681cbb4c61dd4fe03341cfd8d2b796366a0372b53dd3e1d52c9e6ff98692d1 | d9a6b5dd2123c4c2cbd55d81fd22ab72bf7ceb1489a5a770e10bcf67137 54681cbb4c61dd4fe03341cfd8d2b796366a0372b53dd3e1d52c9e6ff98692d1 a7f31c98147d98ac08f4b8afe7faa2f2b4aab821655717f4bde519fcd87 |
| sha256 | 6161c01fd590c98c6dee4e510ba9be4f574c9cc5c89283dbff6bb79cd9383d70 | 1/u.exe. According to VT information, this sample with hash 6161c01fd590c98c6dee4e510ba9be4f574c9cc5c89283dbff6bb79cd9383d70 is detected as a Redline variant (Figure 8): Figure 8: Viru |
| sha256 | 67bbffb2ff5f724a201445f26018cb09fbf0588689f98f90fd82082aae7c6eec | d7659efb8bfb997dec3259d6eb090d4e6a4609e4c0666e04ad612151d71 67bbffb2ff5f724a201445f26018cb09fbf0588689f98f90fd82082aae7c6eec da2a0d9a6b5dd2123c4c2cbd55d81fd22ab72bf7ceb1489a5a770e10bcf |
| sha256 | 6a980d7659efb8bfb997dec3259d6eb090d4e6a4609e4c0666e04ad612151d71 | b4aaddbcb04048be963ea7d669c2ff7a69642d027f88812a5c6c1ade955 6a980d7659efb8bfb997dec3259d6eb090d4e6a4609e4c0666e04ad612151d71 67bbffb2ff5f724a201445f26018cb09fbf0588689f98f90fd82082aae7 |
| sha256 | 6ce64dedbe81c36aef38fd2d567f6ab9737df708591dc2f0cafa56db26a1d043 | 05f488f8439688a02cc6ef84f939d16169117b489219b688a3ea482e5ed 6ce64dedbe81c36aef38fd2d567f6ab9737df708591dc2f0cafa56db26a1d043 1e0b92485e09ac970ae38214fb5c7407f73027ada47ea697017e49cacb5 |
| sha256 | 7ba3eaee591cc73ab85aeb09d8c02b1e569b9dcaffcbc7c4473f504f939697d2 | 0115a9a877a9517c99b16e5a2df9cf7c5eb1fb249d9153b68e8fa94e60b 7ba3eaee591cc73ab85aeb09d8c02b1e569b9dcaffcbc7c4473f504f939697d2 The metadata in these samples indicate they were created on |
| sha256 | 7f66f4411983001d29236c5d3fb4ff26f01b5742badca1db8d49264c01ba506c | pertaining to a Microsoft development unit in Puerto Rico. 7f66f4411983001d29236c5d3fb4ff26f01b5742badca1db8d49264c01ba506c 1b2ed05f488f8439688a02cc6ef84f939d16169117b489219b688a3ea48 |
| sha256 | 8fda14f91e27afec5c1b1f71d708775c9b6e2af31e8331bbf26751bc0583dc7e | l part of the “AA” Qakbot campaign from June and July 2022: 8fda14f91e27afec5c1b1f71d708775c9b6e2af31e8331bbf26751bc0583dc7e 2f9da7145056a4217552a5a536ceb8365e853fbd04d28ae2d494afb20e9 |
| sha256 | 9c7e01c2c39dadc020a0cf8dc74b62e6453b56413f09705b4ad4d391981f5a3f | ps between these hashes in VT, we can see that the LNK file 9c7e01c2c39dadc020a0cf8dc74b62e6453b56413f09705b4ad4d391981f5a3f seen in Figure 11 leads to a Bumblebee DLL while other hash |
| sha256 | a7f31c98147d98ac08f4b8afe7faa2f2b4aab821655717f4bde519fcd87300ac | cbb4c61dd4fe03341cfd8d2b796366a0372b53dd3e1d52c9e6ff98692d1 a7f31c98147d98ac08f4b8afe7faa2f2b4aab821655717f4bde519fcd87300ac c5c0daaa26815bb6528332dd4f56f7eb72db4456d5a84b8bc69239c4507 |
| sha256 | beacb63904c2624ae02601f283671b3ef61650109aea3259b63a0aeefe4133fa | mpaign, and linked to other malware. For example the sample beacb63904c2624ae02601f283671b3ef61650109aea3259b63a0aeefe4133fa, which was submitted on August 15th, 2022, contains Powersh |
| sha256 | c5c0daaa26815bb6528332dd4f56f7eb72db4456d5a84b8bc69239c45079a1c4 | c98147d98ac08f4b8afe7faa2f2b4aab821655717f4bde519fcd87300ac c5c0daaa26815bb6528332dd4f56f7eb72db4456d5a84b8bc69239c45079a1c4 efdb91497fe213e8f696065c2fe81f64cbaa219da16e2b3f8e1e146d098 |
| sha256 | c9dfafd3536977289b4bfda1369fbd113a778cf06ac0c01cdc8e00e1c300e774 | 1497fe213e8f696065c2fe81f64cbaa219da16e2b3f8e1e146d098652b5 c9dfafd3536977289b4bfda1369fbd113a778cf06ac0c01cdc8e00e1c300e774 e818b0115a9a877a9517c99b16e5a2df9cf7c5eb1fb249d9153b68e8fa9 |
| sha256 | da2a0d9a6b5dd2123c4c2cbd55d81fd22ab72bf7ceb1489a5a770e10bcf67137 | fb2ff5f724a201445f26018cb09fbf0588689f98f90fd82082aae7c6eec da2a0d9a6b5dd2123c4c2cbd55d81fd22ab72bf7ceb1489a5a770e10bcf67137 54681cbb4c61dd4fe03341cfd8d2b796366a0372b53dd3e1d52c9e6ff98 |
| sha256 | e818b0115a9a877a9517c99b16e5a2df9cf7c5eb1fb249d9153b68e8fa94e60b | fd3536977289b4bfda1369fbd113a778cf06ac0c01cdc8e00e1c300e774 e818b0115a9a877a9517c99b16e5a2df9cf7c5eb1fb249d9153b68e8fa94e60b 7ba3eaee591cc73ab85aeb09d8c02b1e569b9dcaffcbc7c4473f504f939 |
| sha256 | e89cd1999517b47805106111e14de4a03669cac30adb3b3304655febce25955f | hours later the same user submitted another file with hash e89cd1999517b47805106111e14de4a03669cac30adb3b3304655febce25955f, this time with user information sanitized, and packaged in |
| sha256 | efdb91497fe213e8f696065c2fe81f64cbaa219da16e2b3f8e1e146d098652b5 | aaa26815bb6528332dd4f56f7eb72db4456d5a84b8bc69239c45079a1c4 efdb91497fe213e8f696065c2fe81f64cbaa219da16e2b3f8e1e146d098652b5 c9dfafd3536977289b4bfda1369fbd113a778cf06ac0c01cdc8e00e1c30 |
| url | http://88.198.148.231/u.exe | tains Powershell code to download and execute a binary from hxxp://88.198.148[.]231/u.exe. According to VT information, this sample with hash 6161c |
From the original article
13 min read at blog.talosintelligence.com
Adversaries’ shift toward Shell Link (LNK) files, likely sparked by Microsoft’s decision to block macros, provides the opportunity to capitalize on information that can be provided by LNK metadata. Cisco Talos analyzed metadata in LNK files and correlated it with threat actors tactics techniques and procedures, to identify and track threat actor activity.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.