The following analysis covers the technical details of the file and the "Winter Vivern" campaigns associated with it.
: The archive generally contains a malicious LNK file (Windows Shortcut) disguised as a document or folder [1, 4]. Infection Chain : Winter Loversland.zip
: The PowerShell script connects to a Command and Control (C2) server to download additional malware, often MASEPIE or OCEANLOOS [2, 4]. The following analysis covers the technical details of
: When the user opens the LNK file, it triggers a hidden PowerShell command [3, 5]. often MASEPIE or OCEANLOOS [2