Hackers weaponize LNK files to deploy AutoIt malware

Hackers are using weaponized LNK files to deploy AutoIt malware, causing concern in the cybersecurity community.

The LNK Malware Infection

The infection chain starts with what appears to be a harmless LNK file. However, upon examination, it contains a malicious command disguised as an image file. This command is crafted to download and execute an HTA file using PowerShell from a remote server.

Researchers have proactively downloaded and analyzed the contents of this file in a secure environment. While HTA files typically contain HTML and JavaScript commands, this particular HTA file was found to be packed with binary commands, suggesting an embedded file within.

Upon extraction, both an image and an executable file were uncovered. To verify the legitimacy of the executable, which appeared to mimic the official calc.exe, researchers ran a VirusTotal query.

In order to operate, the HTA file requires readable script code. Upon searching for the term “script,” researchers discovered JavaScript code, which they then beautified.

Within this code, a string of ASCII characters in decimal format was found, indicating encoding. Utilizing the Chrome console, researchers were able to automatically deobfuscate the code, uncovering a custom encoding process.

The researchers at Docguard conducted a meticulous analysis of the malware, systematically removing layers of obfuscation to comprehensively understand its capabilities.

The malware’s code was additionally encrypted using the AES algorithm. Decrypting this layer revealed Layer 2 PowerShell commands. To access the final layer, Layer 3, the encrypted string in the Maf function, which is considered the main function, had to be decrypted using PowerShell.

The payload, solaris.exe, retrieved from the remote server, was examined using Detect it Easy, uncovering an embedded ZIP file. Upon extraction, the file named United revealed obfuscated CMD commands. A custom script was devised to parse these commands, rendering them readable and exposing their functions, including process checks, file operations, and pinging the local host.

The AutoIt file, housing encoded strings, was decoded through a function named lambdaok. Following removal of unused variables and functions, a reverse search pinpointed and eliminated unnecessary commands, revealing critical instructions employed by the attackers.

IOC

‍Follow Us on: Twitter, Instagram, Facebook to get the latest security news!