Trojan:Win32/Malgent!lnk

The infection process for Trojan:Win32/Malgent!lnk starts with a technique known as DLL sideloading. In these cases, threat actors deliver ZIP archives through social platforms, including LinkedIn or WhatsApp. These files are presented as legitimate installers for software like Sumatra PDF or Google IAP Desktop, or as documents related to employment opportunities. When the user launches the Malagent binary, it triggers a legitimate application to load a malicious DLL file that it has placed in the same directory; this DLL hijacks the trusted process. The attack then progresses through several stages.  

First, in the launch and memory injection phase, Malagent deploys a secondary DLL directly into device memory to avoid creating a detectable file on the disk; this DLL functions as the main backdoor. For persistence, it ensures that it remains after a reboot by creating Scheduled Tasks or by making changes to Windows Registry auto-start locations. Command and control (C2) communication is conducted over standard HTTP or HTTPS protocols to receive instructions from threat actors, often using hijacked legitimate websites as proxies to disguise this traffic.  

Critical indicators of compromise (IoCs) to aid identification include specific dropped files like Wdscore.dll, a modified libmupdf.dll, Google.Solutions.IapDesktop.Application.dll, or server.exe and svchost.exe located in non-standard paths such as %AppData% or %Temp%. Registry keys are often modified for persistence, including paths under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, as well as COM hijacking entries like HKCU\Software\Classes\CLSID\{...}\InprocServer32. Network indicators involve historical IP addresses such as 103[.]207.85[.]8, 62[.]204.41[.]189, and 172[.]115.177[.]224, and the use of typosquatted domain names that resemble trusted sites.