MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d398f11c236a59e44a9dff6f99af3aacefcb4a4bdf77bb7cf790cd0b13b0439a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 9 File information Comments

SHA256 hash:	d398f11c236a59e44a9dff6f99af3aacefcb4a4bdf77bb7cf790cd0b13b0439a
SHA3-384 hash:	a7da9a079d7dc04536f8644cc69f7a21f42166f63e894836567d4e29aff8e4853122d78584f335a5ff93864d4fdece1b
SHA1 hash:	a8fbf9c78c1c1a3f34bf18bc6c2aedfa842fe15c
MD5 hash:	fa87911771a52e3c1ffb1c39da59540c
humanhash:	gee-uniform-florida-tennessee
File name:	CV_OlesiaTsvientukh_SocialResearcher_Sociologist_Qualitative.lnk
Download:	download sample
File size:	333'814 bytes
First seen:	2026-09-22 10:55:57 UTC
Last seen:	2026-09-22 11:01:59 UTC
File type:	lnk
MIME type:	application/x-ms-shortcut
ssdeep	6144:R3ORfxkzQfSWD/MUwWR2nOvN9rkkrnpfGMLQYSvwTFxZPNs94SE:RyfxksfSWDEsR2apOMLl29k
TLSH	T1D464F020484C7CDEC26197F14B1F7D1E760D72B6F6C486953BACCB8643A0A2BA45362F
Magika	lnk
Reporter	SOCRadarSTRU
Tags:	lnk Operation_Conflict_Compass STRU

SOCRadarSTRU

🚨 Operation Conflict Compass: Konni Targets Ukraine via Malicious LNK Lures | SOCRadar STRU IOC

SOCRadar Threat Research Unit (STRU) uncovered Operation Conflict Compass, a targeted campaign by the DPRK-aligned actor Konni, aimed at gathering intelligence on the ongoing trajectory of the Russian invasion of Ukrain. Initial access was likely established through spear-phishing emails containing ZIP attachments. These archives contained LNK files masquerading as PDFs, using lures focused on global food price growth due to the Strait of Hormuz situation, Russia-Ukraine peace negotiation frameworks, and social researcher resumes to deceive targets. Execution of these lures leads to the deployment of custom malware that we named VelvetCake. VelvetCake embeds no fixed post-exploitation capability set locally. It operates as a lightweight task runner that continuously retrieves and executes server-side PowerShell modules, allowing operators to modify functionality without redeploying the core payload.

📚 Source: https://socradar.io/blog/operation-conflict-compass-konni-ukraine-lnk-lure/

🔍 IOC Reference:
Full IOC list available on the SOCRadar platform: https://platform.socradar.com/

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

LNK

Details

Link:

https://research.acce.ciphertechsolutions.com/results/87161cda-f142-4572-8027-50368aa6aea8/

Detection(s):

SecuriteInfo.com.LNK.Agent-HV.72896295.UNOFFICIAL

Result

Verdict:

Malicious

File Type:

LNK File - Malicious

Link:

https://app.docguard.net/d398f11c236a59e44a9dff6f99af3aacefcb4a4bdf77bb7cf790cd0b13b0439a/results/dashboard

Payload URLs

URL

File name

https://raw.githubusercontent.com/omskiwdcvoiuyfd0998/0ijnbjfke8djfefhkehhdkefkeu90djfkefh/refs/heads/main/LICENSE

LNK File

Behaviour

BlacklistAPI detected

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive explorer lolbin persistence powershell

Link:

https://www.filescan.io/uploads/6ab25ed43da521ccc194d88f/reports/34cd5e28-e6d9-4e20-bf90-cd60c9acf778/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/d398f11c236a59e44a9dff6f99af3aacefcb4a4bdf77bb7cf790cd0b13b0439a

Verdict:

Malicious

File Type:

lnk

First seen:

2026-09-03T13:55:00Z UTC

Last seen:

2026-09-23T03:45:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/d398f11c236a59e44a9dff6f99af3aacefcb4a4bdf77bb7cf790cd0b13b0439a/results?tab=lookup

Verdict:

Malware

YARA:

3 match(es)

Tags:

DeObfuscated LNK PowerShell T1027 T1059.001 T1105

Link:

https://app.malva.re/file/fa87911771a52e3c1ffb1c39da59540c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d398f11c236a59e44a9dff6f99af3aacefcb4a4bdf77bb7cf790cd0b13b0439a/

Threat name:

Shortcut.Trojan.WinLnk

Status:

Malicious

First seen:

2026-09-03 17:03:49 UTC

File Type:

Binary

Extracted files:

AV detection:

17 of 36 (47.22%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2ompchbdnjm6isu575xztlz2vtx4wssl3533w7hxsdgqwe5qiona._file

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery execution persistence

Link:

https://tria.ge/reports/260922-m1tg3azt7k/

Behaviour

Enumerates system info in registry

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

cURL User-Agent

Browser Information Discovery

Enumerates physical storage devices

Executes a command shell one-liner

System Time Discovery

Drops file in Windows directory

Command and Scripting Interpreter: PowerShell

Executes a VBScript file via the Windows Script Host.

Contacts third-party web service commonly abused for C2

Checks computer location settings

Badlisted process makes network request

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d398f11c236a59e44a9dff6f99af3aacefcb4a4bdf77bb7cf790cd0b13b0439a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CDN_in_LNK Create hunting rule
Author:	@bartblaze
Description:	Identifies CDN (Content Delivery Network) domain in shortcut (LNK) file.

Rule name:	Download_in_LNK Create hunting rule
Author:	@bartblaze
Description:	Identifies download artefacts in shortcut (LNK) files.

Rule name:	High_Entropy_LNK Create hunting rule
Author:	@bartblaze
Description:	Identifies shortcut (LNK) file with equal or higher entropy than 6.5. Most goodware LNK files have a low entropy, lower than 6.

Rule name:	Large_filesize_LNK Create hunting rule
Author:	@bartblaze
Description:	Identifies shortcut (LNK) file larger than 100KB. Most goodware LNK files are smaller than 100KB.

Rule name:	PDF_in_LNK Create hunting rule
Author:	@bartblaze
Description:	Identifies Adobe Acrobat artefacts in shortcut (LNK) files. A PDF document is typically used as decoy in a malicious LNK.

Rule name:	PS_in_LNK Create hunting rule
Author:	@bartblaze
Description:	Identifies PowerShell artefacts in shortcut (LNK) files.

Rule name:	Script_in_LNK Create hunting rule
Author:	@bartblaze
Description:	Identifies scripting artefacts in shortcut (LNK) files.

Rule name:	SUSP_LNK_Big_Link_File Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a suspiciously big LNK file - maybe with embedded content
Reference:	Internal Research

Rule name:	SUSP_LNK_Big_Link_File_RID2EDD Create hunting rule
Author:	Florian Roth
Description:	Detects a suspiciously big LNK file - maybe with embedded content
Reference:	Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample