DeerStealer Malware Distributed via Malicious .LNK and LOLBin Techniques

A recent cyber threat campaign has been uncovered leveraging highly obfuscated Windows shortcut files (.LNK) to distribute the infostealer malware DeerStealer.

The attack sequence utilizes well-known “living-off-the-land binaries” (LOLBin) techniques, particularly through mshta.exe abuse (MITRE ATT&CK T1218.005), to bypass standard endpoint defenses and deliver the malware via a multi-stage execution chain.

Obfuscated Execution Chain

The campaign initiates with a deceptively benign shortcut file, typically named “Report.lnk,” which conceals a sophisticated script sequence.

When activated, the .LNK file covertly launches mshta.exe, a legitimate Windows utility for executing HTML applications, often exploited by threat actors for its ability to execute remote and local scripts.

To avoid detection, the execution command employs deliberately complex wildcard paths and obfuscation, frustrating signature-based and static analysis by security tools.

This launch triggers cmd.exe and eventually PowerShell, where further obfuscated payloads often encoded in Base64 undergo a series of decoding and execution steps.

One notable evasion tactic includes disabling both logging and behavioral profiling in PowerShell, thus minimizing the digital forensics footprint during and after execution.

The PowerShell scripts dynamically resolve the exact location of mshta.exe on the infected system, further complicating detection efforts that rely on hardcoded indicators or standard execution paths.

Dynamic Script Decoding

The actual malicious logic is protected within a multi-layered encoding scheme. Encoded characters are processed in pairs, converted from hexadecimal to ASCII, reassembled, and ultimately unpacked as executable PowerShell code the payload remaining hidden until the precise moment of execution.

This layered approach not only prevents straightforward static analysis but also enables dynamic runtime modifications in an attempt to defeat behavioral heuristics.

To further mask its true intent and reduce suspicion, the attack drops and opens a decoy PDF document in Adobe Acrobat, distracting the victim while DeerStealer’s core binary is quietly written to the %AppData% directory and executed in the background.

PowerShell orchestrates both the downloading of the fake PDF and the deployment of the malware, using dynamically constructed URLs derived from obfuscated string arrays embedded in the script. This ensures both flexibility in infrastructure and resistance to simple IOC-based detection.

Security researchers using platforms like ANY.RUN have mapped the full attack chain in real-time.

The platform’s Script Tracer capability dissects each stage exposing the use of wildcards with LOLBins, encoded script content, and evidence of command-and-control network traffic without manual deobfuscation.

This level of analysis provides defenders with deeper insight into the evolving arsenal of techniques used by DeerStealer’s operators, highlighting the increasing necessity for dynamic behavioral analytics in enterprise defense frameworks.

The DeerStealer campaign underscores the ongoing evolution of infostealer delivery tactics, emphasizing the cybercriminals’ preference for LOLBins and advanced obfuscation for maximum stealth.

Enterprises are urged to enhance defensive strategies with behavioral analytics, script tracing, and real-time process monitoring.

Indicators of Compromise (IoC)

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant updates