HVNC backdoor

The lure page silently fingerprints the visitor’s browser, OS, timezone, and screen size before deciding whether to release a payload.

The campaign uses fake DocuSign notifications, NFe tax documents, and banking-themed phishing; the entry point is a cloned DocuSign “your document is ready” page.

The shortcut’s real target is powershell.exe, run with -WindowStyle Hidden -ExecutionPolicy Bypass, executing a one-liner that downloads and executes a second-stage binary.

Inside the ZIP sits a Windows .lnk shortcut disguised as an NFe confirmation, alongside five decoy .txt files with fabricated company data.

UpdateAssistant.exe copies itself ... into %APPDATA%\Roaming\Programs\Common\, renaming the executable to AppUpdateHelper.exe, then drops a shortcut into the current user’s Startup folder.

Credential provider enregistré, chargement dans LSA au démarrage, survie en safe mode.

Credential provider enregistré, chargement dans LSA au démarrage.

UpdateAssistant.exe copies itself ... into %APPDATA%\Roaming\Programs\Common\, renaming the executable to AppUpdateHelper.exe, then drops a shortcut into the current user’s Startup folder.

Credential provider enregistré, chargement dans LSA au démarrage, survie en safe mode.

The C2 host is stored as 12 raw bytes, XOR-encoded with a single byte (0x37). A second function decodes browser names using a different XOR key.

The 64-bit backdoor masquerad[es] as “Windows Update Assistant” / Microsoft Corporation in its version metadata, while unsigned.

The LNK is disguised as a tax receipt, while the unsigned payload claims to be Microsoft Corporation’s “Windows Update Assistant” and later renames itself AppUpdateHelper.exe.

The page runs a small anti-bot gauntlet: it checks navigator.webdriver, zero-size browser windows, and known headless-browser artifacts, then waits for genuine mouse/scroll/keyboard events before arming the download.

Static analysis told us the malware could create a hidden desktop (CreateDesktopA, SetThreadDesktop), capture the screen, inject input, and poll the keyboard state.

Credential provider enregistré, chargement dans LSA au démarrage.

The malware monitors keystrokes; static analysis found it could poll the keyboard state.

The payload contains hardcoded references to Firefox cookies.sqlite and is described as stealing Firefox cookies.

The malware targets Firefox cookies, browsing history, and permissions.

Credential provider enregistré, chargement dans LSA au démarrage.

The handshake ... checks in with a full victim fingerprint — CPU model, RAM, architecture, and ... antivirus-discovery results.

Hardcoded Firefox places.sqlite and permissions.sqlite strings identify browser history and permission-store targeting.

The page runs a small anti-bot gauntlet: it checks navigator.webdriver, zero-size browser windows, and known headless-browser artifacts, then waits for genuine mouse/scroll/keyboard events before arming the download.

The malware checks for more than 20 AV/EDR processes and adjusts its behavior when security software is present.

The malware monitors keystrokes; static analysis found it could poll the keyboard state.

HVNC functionality lets attackers interact with the compromised system through a hidden desktop, including screen capture and simulated mouse and keyboard input.

All [capabilities communicate] over TCP/27015 ... The stream switches to a binary frame format consistent with screen-tile data.

Invoke-WebRequest ... downloads a second-stage binary and runs it.

The payload creates a hidden virtual desktop and supports screen capture plus simulated mouse and keyboard input for operator control.

The destination port is stored in plaintext: 27015 — the default port for Source-engine games like Counter-Strike. Reusing a gaming port ... blends the beacon into ordinary consumer traffic.

The C2 host is stored as raw bytes XOR-encoded with key 0x37; browser strings use a second XOR key.