Executive Summary
Analysis of a malicious Windows shortcut (LNK) named 'OIC_Invitation_General_Official.lnk' reveals a multi-stage infection chain used to deploy the PlugX malware. The attack begins with a PowerShell command that downloads a hidden archive using native Windows utilities (curl and tar). Once extracted, the malware leverages DLL side-loading by placing a malicious DLL (ssce5532.dll) in the same directory as a legitimate Jarte-derived executable, which then decodes the primary PlugX payload from an obfuscated data file.
The payload establishes persistence on the host via the Registry Run keys and initiates command-and-control (C2) communication with the domain castanaksa[.]com over port 443. The malware provides extensive remote access capabilities, including file management, process control, and host profiling. The use of a decoy PDF themed around an 'OIC Invitation' suggests the campaign targets government or diplomatic entities frequently associated with the Organisation of Islamic Cooperation (OIC).
This threat is critical due to its use of legitimate application components to bypass security controls and its highly functional remote access toolkit. Organizations should monitor for the specific indicators of compromise (IOCs) and side-loading patterns identified in this report.