MedusaHVNC Malware Uses Hidden Windows Desktops to Evade Detection
MedusaHVNC is a sophisticated remote access trojan (RAT) sold as a service, utilizing hidden Windows desktops to evade detection and maintain a persistent presence on victims' systems. BlackFog researchers discovered the malware’s use of legitimate Windows functions through a hidden desktop, allowing attackers to operate undetected and exfiltrate data. The malware employs a multi-stage infection chain and leverages advanced encryption techniques to further obscure its activity.
MedusaHVNC is a remote access trojan (RAT) being sold as a service, utilizing hidden Windows desktops to evade detection and maintain a persistent presence on victims’ systems. BlackFog researchers discovered the malware’s use of legitimate Windows functions through a hidden desktop, allowing attackers to operate undetected and exfiltrate data. The malware employs a multi-stage infection chain. It starts when the legitimate `wscript.exe` executes a JScript launcher. The script waits for just over 7.5 seconds and then builds its embedded files under `%TEMP% x2981okk2`.
Several files are written to disc, including an encrypted payload and a `.bat` in the Startup folder to maintain persistence. Windows AutoIT is used to decrypt the payload and start `charmap.exe` (the Windows character map utility). The loader, now inside `charmap.exe`, contains two further layers of encryption. "The first applies a 16-byte repeating XOR operation to 1,099,152 bytes from the `.data` section. The second uses ChaCha20 to decrypt 998,912 bytes of ciphertext with a 32-byte key, a 12-byte nonce, and an initial counter value of 1," write the researchers.
The installed final payload ‘is an unsigned PE32+ x86-64 console executable containing a `.pay` section and the family string MedusaHVNC.’ It communicates with the operator’s C2 at a hardcoded address: 51.89.204.28:4444.
The operator can create a browser of choice within the hidden desktop from Chrome, Edge, and Firefox. Legitimate Windows functions, including `BitBlt`, `EnumWindows`, and `PrintWindow` support screen and window capture, while `SendInput` and `SetWindowsHookExW` are associated with synthetic input and interaction.
"Clipboard functions, including `OpenClipboard`, `GetClipboardData`, and `SetClipboardData`, provide another way to move information into or out of the session," comment the researchers.
The hidden desktop allows the attacker to take full advantage of legitimate Windows tools without being observed by the user. The C2 is hardcoded into the malware but is relatively safe from observation. The result is a stealthy and persistent RAT.