Hashes from LNK file campaign

LNK_IOCs.md

Original File

7eb4ea6277bd62653cc474cf1125165c9bdc43858811c0d88be25e2ec34bc14d

k.dll

95b2d037d67d77d313a7c97912674e365dcd98ceb6f8942ef3d450abf20bf472

screenshots.dll

35145e1641b0e8bba2981573f9c8701f5f12caa50621bfc482dadd3982975244

Retrohunt LNK Hashes

7eb4ea6277bd62653cc474cf1125165c9bdc43858811c0d88be25e2ec34bc14d 65469ae4cb1f05ea1b7a174cbdfbb63021cc2971693a29e226dc510dec20dc3e d7d74fafc0c4a65e080c04479a0f1fd1da8cd34aee59e88ac49de3f844362416 20026af8c1bd95d4a39c2d1d1c2909ed133a5d2efac2d6c6b87cbc4d2782fef0 48de3d2ba47f482e912792ef677fec95557da5d14eb65321ff8290e59531076a 62901e68c0c990a7ee69a2954f931dc643be430a8d09f316974d88a0ed97a268 26fd8d1abe275f611779951c1687c3e04091dba12147500409e2db59b7bf6de1 2f92936228e4e83ddcb040267bac970908c4d3ed41bc636f808feb7a2eb60044 bbd2a1f2cb9b929e4ca09310caeb43c7257ebdd7c3872b8f62645eb659c4c89d

Yara

rule weird_LNK
{
meta:
author = "@mattnotmax"
date = "2020-05-28"
strings:
$SID = "S-1-5-21-2529457200-49751210-1696528657" wide
condition:
uint16(0) == 0x00004c and $SID
}