Deep Dive: A LNK in the Chain

This report analyzes a multi-stage PowerShell malware chain delivered via a malicious LNK file: mshta is used to run obfuscated VBScript that invokes PowerShell to decode embedded data, which makes staged HTTP(S) POST/GET requests to retrieve and execute additional PowerShell payloads. The final stage fingerprints the host (including VM/sandbox checks), enumerates installed applications and antivirus, implements RC4 encryption/decryption, collects system data and external IP, and posts results to a C2 endpoint while executing received commands.