LOLBin Tools Exploit .LNK Files to Distribute DeerStealer Malware

Cybersecurity researchers have identified a sophisticated phishing campaign that leverages obfuscated .LNK shortcut files and Living Off The Land Binary (LOLBin) techniques to deliver DeerStealer malware.

The attack exploits legitimate Windows system tools, particularly mshta.exe, to execute malicious payloads while evading traditional security detection mechanisms.

The campaign begins with victims receiving what appears to be a PDF document shortcut named “Report.lnk.” However, this seemingly innocuous file serves as the initial attack vector, covertly launching a complex execution chain designed to compromise target systems.

The technique falls under the MITRE ATT&CK framework classification T1218.005, which involves abusing signed binaries to execute malicious code.

Complex Execution Chain Employs Multiple System Tools

The attack follows a carefully orchestrated sequence: the malicious .LNK file invokes mshta.exe, which subsequently launches cmd.exe, followed by PowerShell, ultimately deploying the DeerStealer payload.

This multi-stage approach creates multiple layers of obfuscation, making detection and analysis significantly more challenging for security teams.

The PowerShell component dynamically resolves the full path to mshta.exe within the System32 directory, launching it with specific flags followed by heavily obfuscated Base64-encoded strings.

To further complicate forensic analysis, the malware disables both logging and profiling capabilities during execution, reducing the digital footprint left behind on compromised systems.

Advanced Obfuscation Techniques Mask Malicious Intent

The malware employs sophisticated encoding mechanisms to conceal its true purpose until runtime. Characters are decoded in pairs, converted from hexadecimal to ASCII format, then reassembled into executable scripts through PowerShell’s Invoke-Expression (IEX) command.

This dynamic approach ensures that malicious logic remains hidden from static analysis tools.

The script dynamically resolves URLs and binary content from obfuscated arrays, downloads a legitimate-appearing PDF document to distract victims, and writes the primary executable to the AppData directory for silent execution.

The fake PDF opens in Adobe Acrobat, creating the illusion of a standard document while the malware operates in the background.

Security researchers have identified several Indicators of Compromise (IOCs) associated with this campaign, including the domain tripplefury[.]com and specific file hashes: fd5a2f9eed065c5767d5323b8dd928ef8724ea2edeba3e4c83e211edf9ff0160 and 8f49254064d534459b7ec60bf4e21f75284fbabfaea511268c478e15f1ed0db9.

The campaign showcases the evolving sophistication of modern malware distribution methods, underscoring the crucial need for advanced behavioral analysis tools and comprehensive endpoint detection capabilities.

Organizations are advised to implement robust email filtering, user education programs, and dynamic analysis solutions to protect against such evasive threats.