Suspected Sapphire Mushroom (APT-C-12) malicious LNK files
released on 2020-02-12 @ 10:42:46 PM
In July 2018, the Chinese-based research group 360 Technical Intelligence Center (TIC) produced a report "蓝宝菇（APT-C-12）针对性攻击技术细节揭秘" (Sapphire Mushroom (APT-C-12) Technical Details Revealed. This report analyzed a malicious LNK file allegedly used by the APT group "Sapphire Mushroom" (蓝宝菇 aka Blue Mushroom aka NuclearCrisis).
Flash-forward to January 2020 and I was trawling through Hybrid-Analysis searching for interesting LNK files, I came across these five samples.