Threat Actors Weaponize LNK Files To Deploy MoonPeak Malware On Windows

Threat actors, linked to North Korea (DPRK), weaponized LNK shortcut files to deploy MoonPeak malware a variant of XenoRAT.

The malicious file masqueraded as “실전 트레이딩 핵심 비법서.pdf.lnk” (Real Battle Trading Core Secret Book.pdf.lnk), luring investors with fake trading guides.

This campaign highlights DPRK’s ongoing foreign currency theft efforts, evading detection through anti-analysis tricks and trusted sites like GitHub.

When victims double-click the LNK, it triggers two actions. First, an XOR-encoded PDF decoy opens to distract users. Second, an obfuscated PowerShell script runs hidden (-WindowStyle Hidden).

This script checks for over 40 analysis tools and virtual environments, killing execution if detected.

Targets include VMware processes like vmtoolsd.exe, vboxservice.exe, and debuggers such as dnSpy.exe, IDA Pro, Wireshark, and ProcMon.

If the environment passes checks, the script creates a random 8-character folder in temp directories. Inside, it drops two files with random names: a PowerShell script (Figure 1 equivalent) and a VBScript (Figure 2).

The PowerShell fetches another script from hxxp://mid[.]great-site[.]net/realzan/viewpoi.txt, saves it temporarily, executes it, then deletes it.

The VBScript launches this PowerShell bypassing execution policies, hidden. A scheduled task named “Selling CoinBoruhde Whistling NOprobnl{BD234234324-1243324ADVE}” ensures persistence via wscript.exe.

The script also beacons system details host info, OS version, processes to hxxp://mid[.]great-site[.]net/maith.php via POST.

It appends a random 4-char string plus “BEGIN,” and AES-decrypts data using JS from hxxp://mid[.]great-site[.]net/aes.js, likely notifying attackers of infection.

Infection Chain and MoonPeak Deployment

The downloaded viewpoi.txt PowerShell accesses raw.githubusercontent.com, pulling octobor.docx from the now-takedown GitHub repo macsim-gun/FinalDocu (reported by IIJ).

Commit author: sandamalmacsim@gmail[.]com (verified account). The script swaps the file’s first 7 bytes to a GZIP header (1F 8B 08 00 00 00 00), decompresses it in memory, revealing Stella.exe. PowerShell’s Assembly.Load executes this .NET binary directly.

Stella.exe is MoonPeak, obfuscated with ConfuserEx to thwart decompilers like dnSpy. Anti-tampering decrypts code dynamically in <Module>.<Module>(). IIJ extracted and deobfuscated it with de4dot-cex. Key configs: Mutex “Dansweit_Hk65-PSAccerdle”; C2 at 27.102.137[.]88:443.

According to Internet Initiative Japan, capabilities match Trellix’s 2025 report on DPRK espionage via GitHub C2. Cisco Talos tracks actors as UAT-5394.

This LOTS (Living Off Trusted Sites) tactic persists, using GitHub for payloads. DPRK targets expand beyond governments to individuals worldwide. Defend by blocking IOCs, monitoring LNK/PowerShell, and scanning for ConfuserEx artifacts.

IoCs

Files (SHA256):

Domains/IPs:

• mid.great-site[.]net
• hxxps://raw[.]githubusercontent[.]com/macsim-gun/FinalDocu/main/octobor.docx
• 27.102.137[.]88:443

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.