Havoc Stager Masquerades as Microsoft Defender DLP in Brazilian Invoice Campaign
Summary
LevelBlue SpiderLabs details a Brazilian NF-e-themed campaign in which an unsigned, Microsoft-branded MSI installs an endpointdlp.dll stager that fetches Havoc at runtime. Analysis links nine stager variants and provides a YARA rule and hunting guidance.
Key points
- The NF-e-themed ZIP contained an obfuscated 503-byte VBScript and an unsigned MSI, rather than the PDF and signed XML expected in a legitimate invoice package.
- The MSI drops a signed Microsoft mpextms.exe alongside the unsigned endpointdlp.dll stager, which uses DLL side-loading and downloads the Havoc demon at runtime.
- In a sandbox, the stager made GET /stage/ and POST /api/v2/telemetry/diag requests using a Microsoft Delivery Optimization user-agent.
- LevelBlue identified nine stager variants with shared exports, imports, and spoofed version information; byte-level similarities support a common builder.
- The stager persists through the HKCU Environment UserInitMprLogonScript value, which launches mpextms.exe again at logon.
- Recovered Havoc configurations showed encrypted C2 traffic and options including sleep masking, indirect syscalls, and AMSI/ETW patching.
- The researchers provide a YARA rule for the stager and advise hunting for its network behavior, unsigned Microsoft-branded DLLs, and the persistence value.
Article Details
- Attack Vectors
- A Brazilian NF-e-themed email lure delivers a ZIP containing a 503-byte VBScript and an MSI instead of the PDF and signed XML expected in a legitimate invoice package.
- The VBScript conceals the download and execution steps, fetches the MSI with curl, and runs it silently with msiexec. The MSI drops an unsigned endpointdlp.dll beside the signed mpextms.exe, which loads the DLL.
- The stager communicates with C2 over HTTP, downloads Havoc demon code at runtime, and sets HKCUEnvironmentUserInitMprLogonScript to relaunch mpextms.exe at logon.
- Defensive Notes
- Investigate any non-empty HKCUEnvironmentUserInitMprLogonScript value.
- Verify Authenticode signatures on Microsoft-named binaries arriving in downloaded archives; the article notes that the malicious stager is unsigned.
- Hunt for GET requests to /stage/<32-hex> using the Microsoft-Delivery-Optimization/10.1 user-agent, followed by POST traffic to the reported telemetry paths.
- The published YARA rule targets the stager’s spoofed VERSIONINFO, absent signature, import hashes, and staging and telemetry strings.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 49xb5hoiqsr[.]com | Domain serving the malicious update.zip delivery campaign. |
| DOMAIN | e4wxbrg5277[.]com | Domain serving the malicious update.zip delivery campaign. |
| DOMAIN | jh038x18gy9[.]com | Domain serving the malicious update.zip delivery campaign. |
| IPV4 | 143[.]198[.]183[.]46 | Havoc demon C2 address recovered from a production sample. |
| IPV4 | 194[.]59[.]31[.]192 | Stager C2 address used for the reported staging and telemetry requests. |
| IPV4 | 194[.]62[.]55[.]81 | C2 address in the reported live-target demon build. |
| MD5 | 07d0d4c580ac76ac3ffb63353c9b6b85 | Stager-family import hash identified in the article’s detection guidance. |
| MD5 | 7d384886720c8e576c3ca9d68cb5f08b | Stager-family import hash identified in the article’s detection guidance. |
| SHA256 | 00d979bdb1b29b2859f2120580f101f40e8e13de0b3b7bc29675e2c31098a03c | Hash listed for a member of the related malicious stager family. |
| SHA256 | 1d09357b6a096fdc35cd5c873eed15665d6b3c879d20c8cf01e6bca0005512cf | Hash listed for a member of the related malicious stager family. |
| SHA256 | 1fc515870c681bf3e1b7947e2248bbcfe9918db2978117e91134de20bd42fd6a | Hash listed for a member of the related malicious stager family. |
| SHA256 | 2cd88d5280a61714836f5f07a16df190911c5b952af2998dbbcda910b3b1c494 | Hash listed for a member of the related malicious stager family. |
| SHA256 | 31f27fdc14505e0cebe360579e1ba0326762cbe0948e50b5f920da51fdef1b51 | Hash listed for a standalone Havoc demon executable. |
| SHA256 | 3578e1588846a805ee806fa6151b5801d0acb88879a93d378300e2ee7665736e | Hash identified for the malicious NF-e lure ZIP. |
| SHA256 | 389a6a2007e4f06d16beac0ec2cb01391f80ad5e392343386cae3ceb82ec1502 | Hash listed for a standalone Havoc demon executable. |
| SHA256 | 6b22df0de0a40ff372973639c8a1974cfb75084b8e3b85f9ab9038e0acce43c0 | Hash listed for a standalone Havoc demon executable. |
| SHA256 | 6dc41555455860b8584d761303a7ae5487117944e2a24d74fa3e91ad8f840077 | Hash listed for a standalone Havoc demon executable. |
| SHA256 | 7d4fb94f6b4623690daea67ed52e97705cb102f443988ff605f2a9c4898244dc | Hash identified for the malicious endpointdlp.dll stager recovered from the MSI. |
| SHA256 | 9eefc66d1fca7f18a91f49affb569b41bcde043f91567e7f5cc9f2016aeddf8c | Hash listed for a standalone Havoc demon executable. |
| SHA256 | ae8cded2822c56dd85f52bba09d9285cb2db3e6317227530b848ea143afb067c | Hash listed for a standalone Havoc demon executable. |
| SHA256 | afd5f1ed45a9867daf3bc64152cef460a06b164c8183e490db39146d4749a82c | Hash listed for a stager in the alternate update.zip delivery campaign. |
| SHA256 | c958de72460256c9c1cceef527d880862e8bc29e3ae4e2d478af97dcafd41180 | Hash listed for a standalone Havoc demon executable. |
| SHA256 | ced6b0f4441085bb9c54a32da9ab4ba14c6e21daf6e34fd61d54923f87baacd0 | Hash listed for a member of the related malicious stager family. |
| SHA256 | d24216d0b82747e9406a696da76960183926145f9621947e34a772137f5e22a6 | Hash identified for the malicious MSI in the NF-e delivery chain. |
| SHA256 | d2c637235d62ad766f961f9b8563f6a0e6db2ec0a343470385991b4df826afbc | Hash listed for a member of the related malicious stager family. |
| SHA256 | f2357e70f359803d42298d016c7e1631e9fba6c7e01e5df1eb8fb9ff7eb3df4e | Hash identified for the VBScript in the NF-e delivery chain. |
| SHA256 | fb3630822b70bacb56aa4cec29b5a0e3e9acb3920809e70310a4003385a6d34a | Hash listed for a member of the related malicious stager family. |
| URL | hxxps[:]//storage[.]googleapis[.]com/nodesdownload/update.msi | Specific Google Cloud Storage URL used by the lure’s VBScript to download the malicious MSI. |
| URL | hxxps[:]//thomphon[.]com/api/v1/telemetry | Reported C2 telemetry endpoint for a sibling stager in the update.zip delivery campaign. |
| URL | hxxps[:]//tr[.]ee/lAZ5yi | URL crawler observed this URL serving the malicious invoice ZIP. |
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationThe MSI and stager use Microsoft-themed names and version information to appear legitimate.T1037.001 · Logon Script (Windows)The stager writes UserInitMprLogonScript to relaunch mpextms.exe at logon.T1059.005 · Visual BasicA VBScript launcher runs a hidden command prompt to download and execute the MSI.T1071.001 · Web ProtocolsThe stager and Havoc demon use HTTP requests for C2 communications.T1105 · Ingress Tool TransferThe stager downloads Havoc demon code from C2 after its handshake.T1140 · Deobfuscate/Decode Files or InformationThe VBScript uses string splitting to conceal its download URL and execution steps.T1218.007 · MsiexecThe script runs the MSI silently with msiexec /quiet /norestart.T1566.001 · Spearphishing AttachmentThe lure arrives as an invoice-themed email attachment containing a malicious ZIP.T1574.002 · DLL Side-LoadingThe signed mpextms.exe loads the malicious endpointdlp.dll alongside it.
Malware
Products
Tools
Countries
BrazilInvoice-shaped ZIP attachments imitate Brazil’s Nota Fiscal eletrônica workflow to trick recipients during tax season.MalaysiaThe same stager family also appears in other delivery fronts, including Malaysia-hosted update.zip campaigns and KongTuke-related reporting.TR[URLs] delivery and staging infrastructure – hxxps://storage[.]googleapis[.]com/nodesdownload/update.msi, hxxps://tr[.]ee/lAZ5yi