Quantum Builder Malware

Security researchers with Cyble published a new report on the rise of malware using .lnk shortcut files to deliver their final payload. One highlight of the report was a .lnk file builder called Quantum.

Quantum is sold on hacker forums, as a subscription service, or as a one-time payment for lifetime use. A monthly subscription comes at around 190 EUR and a one-time purchase is a whopping 1500 EUR.

The malware claims to have the ability to spoof any legitimate file extension and comes packaged with 300 different icon types. The advertising materials posted by the malware's authors also claim Quantum can drop the final payload in any directory on the victim system and execute it either on system startup or after a pre-set delay, using Powershell to run the payload with admin account privileges.

Cyble pointed out that under default settings, Windows will hide the .lnk extension, so if the filename is "document.txt.lnk" the file will show up as "document.txt". However, that little trick still keeps the tiny shortcut icon on the bottom left of the file's icon.

The researchers also found a possible link between the Quantum malware and the Lazarus group APT. The deobfuscation instructions and the way in which variables are initialized were essentially the same between a sample used by Lazarus and one using the Quantum builder.