Google Forms Lures Deliver PureHVNC RAT Through Multi-Stage Infection Chain
Summary
Malwarebytes researchers detail a campaign using business-themed ZIP files linked through Google Forms to deploy the PureHVNC .NET RAT. The chain uses DLL hijacking, obfuscated Python and Donut shellcode, process injection, and persistence.
Key points
- Google Forms impersonating legitimate companies link to business-themed ZIP files, sometimes promoted through LinkedIn or hosted on file-sharing services and URL shorteners.
- ZIP archives may contain decoy PDFs, an executable, and a malicious DLL—often msimg32.dll—that uses DLL hijacking to start the infection chain.
- The DLL can decrypt strings, check for debugging or sandboxing, establish persistence, extract final.zip, and launch an obfuscated Python script that loads Donut shellcode.
- The chain ultimately injects PureHVNC, a modular .NET RAT, into a process such as SearchUI.exe; the injected process can vary.
- PureHVNC gathers device and security-product information, collects data from browsers, extensions, cryptocurrency wallets, Telegram, and Foxmail, and can install plugins.
- Researchers observed persistence through scheduled tasks or registry Run keys, and a base64- and GZIP-encoded configuration containing C2 address 207.148.66.14 and ports 56001–56003.
- The article advises verifying Google Forms and business requests through official channels and avoiding untrusted downloads and shortened or redirected links.
Article Details
- Attack Vectors
- Malicious business-themed ZIP files are linked from Google Forms and shared through platforms such as LinkedIn, file-sharing services, and URL shorteners.
- ZIP archives contain a legitimate-looking PDF, an executable, and a malicious DLL, typically msimg32.dll, which is loaded through DLL hijacking.
- The DLL extracts final.zip and launches an obfuscated Python script that decodes and runs Donut shellcode, leading to PureHVNC injection into a process such as SearchUI.exe.
- Defensive Notes
- Check the origin of Google Forms and avoid entering sensitive information or downloading files unless the source is trusted.
- Verify job, partnership, and project requests through official company channels.
- Treat shortened links and redirects with caution.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 207[.]148[.]66[.]14 | C2 address listed in the PureHVNC configuration. |
| SHA256 | 1d533963b9148b2671f71d3bee44d8332e429aa9c99eb20063ab9af90901bd4d | Hash listed as identifying malware or a payload file from the campaign. |
| SHA256 | 258adaed24ac6a25000c9c1240bf6834482ef62c22b413614856b8973e11a79f | Hash listed as identifying malware or a payload file from the campaign. |
| SHA256 | 481360f518d076fc0acb671dc10e954e2c3ae7286278dfe0518da39770484e62 | Hash listed as identifying malware or a payload file from the campaign. |
| SHA256 | 4957b08665ddbb6a2d7f81bf1d96d252c4d8c1963de228567d6d4c73858803a4 | Hash listed as identifying malware or a payload file from the campaign. |
| SHA256 | 59362a21e8266e91f535a2c94f3501c33f97dce0be52c64237eb91150eee33e3 | Hash listed as identifying malware or a payload file from the campaign. |
| SHA256 | 7f9225a752da4df4ee4066d7937fe169ca9f28ecddffd76aa5151fb72a57d54b | Hash listed as identifying malware or a payload file from the campaign. |
| SHA256 | 83ce196489a2b2d18a8b17cd36818f7538128ed08ca230a92d6ee688cf143a6c | Hash listed as identifying malware or a payload file from the campaign. |
| SHA256 | 85c07d2935d6626fb96915da177a71d41f3d3a35f7c4b55e5737f64541618d37 | Hash listed as identifying malware or a payload file from the campaign. |
| SHA256 | 8d6bc4e1d0c469022947575cbdb2c5dd22d69f092e696f0693a84bc7df5ae5e0 | Hash listed as identifying malware or a payload file from the campaign. |
| SHA256 | a92f553c2d430e2f4114cfadc8e3a468e78bdadc7d8fc5112841c0fdb2009b2a | Hash listed as identifying malware or a payload file from the campaign. |
| SHA256 | b18e0d1b1e59f6e61f0dcab62fecebd8bcf4eb6481ff187083ea5fe5e0183f66 | Hash listed as identifying malware or a payload file from the campaign. |
| SHA256 | b78514cfd0ba49d3181033d78cb7b7bc54b958f242a4ebcd0a5b39269bdc8357 | Hash listed as identifying malware or a payload file from the campaign. |
| SHA256 | c149158f18321badd71d63409d08c8f4d953d9cd4a832a6baca0f22a2d6a3877 | Hash listed as identifying malware or a payload file from the campaign. |
| SHA256 | ca6bd16a6185c3823603b1ce751915eaa60fb9dcef91f764bef6410d729d60b3 | Hash listed as identifying malware or a payload file from the campaign. |
| SHA256 | d6b7ab6e5e46cab2d58eae6b15d06af476e011a0ce8fcb03ba12c0f32b0e6386 | Hash listed as identifying malware or a payload file from the campaign. |
| SHA256 | e0ced0ea7b097d000cb23c0234dc41e864d1008052c4ddaeaea85f81b712d07c | Hash listed as identifying malware or a payload file from the campaign. |
| SHA256 | e221bb31e3539381d4753633443c1595bd28821ab6c4a89ad00ea03b2e98aa00 | Hash listed as identifying malware or a payload file from the campaign. |
| SHA256 | e7b9f608a90bf0c1e477a28f41cb6bd2484b997990018b72a87268bf46708320 | Hash listed as identifying malware or a payload file from the campaign. |
| SHA256 | ea4fb511279c1e1fac1829ec2acff7fe194ce887917b9158c3a4ea213abd513a | Hash listed as identifying malware or a payload file from the campaign. |
| SHA256 | fe398eb8dcf40673ba27b21290b4179d63d51749bc20a605ca01c68ee0eaebbc | Hash listed as identifying malware or a payload file from the campaign. |
| URL | hxxps[:]//dl[.]dropbox[.]com/scl/fi/52sgtk50j285hmde2ycry/Overview-of-the-MSI-Accounting-Project.rar?rlkey=9qmunvcp8oleeycld08gqwup9 | Specific Dropbox-hosted archive URL identified as part of the malicious ZIP distribution campaign. |
| URL | hxxps[:]//goo[.]su/CmLknt7 | Shortened URL identified as part of the malicious ZIP distribution campaign. |
| URL | hxxps[:]//www[.]fshare[.]vn/file/F57BN4BZPC8W | File-sharing URL listed among the campaign's malicious URLs. |
MITRE ATT&CK
T1005 · Data from Local SystemPureHVNC enumerates and collects information from browsers, extensions, cryptocurrency wallets, Telegram, and Foxmail.T1027 · Obfuscated Files or InformationThe malware XOR-encrypts strings and uses base64-encoded, GZIP-compressed configuration data.T1041 · Exfiltration Over C2 ChannelThe article describes the collected browser, extension, and wallet information as being exfiltrated and identifies a C2 address in the malware configuration.T1047 · Windows Management InstrumentationPureHVNC runs WMI queries to enumerate antivirus products, devices, and operating-system details.T1053.005 · Scheduled TaskPureHVNC creates a scheduled task using a base64-encoded PowerShell command for persistence.T1055 · Process InjectionPureHVNC is injected into a legitimate process, with SearchUI.exe given as an example.T1059.003 · Windows Command ShellThe chain uses cmd.exe to launch files and run tar extraction commands.T1059.006 · PythonAn obfuscated Python script, such as config.log, decodes and runs Donut shellcode.T1204.002 · Malicious FileThe infection chain begins when a victim downloads and opens a business-themed ZIP linked from a Google Form.T1547.001 · Registry Run Keys / Startup FolderThe DLL establishes persistence through the registry key CurrentVersionRunMiroupdate.T1574.001 · DLLA malicious DLL, typically msimg32.dll, is loaded by a legitimate program through DLL hijacking.
Malware
Products
Dropbox DocSendshellcode, scheduled tasks and process injection (into SearchUI.exe) while using services like Dropbox and URL shorteners to host payloads and C2 infrastructure.Google formsAttackers are using malicious Google Forms linking to business-themed ZIP files (job interviews, project briefs, financial documents) to distribute a multi-stage infection chain that ultimately installs the PureHVNCLinkedInAttackers distribute malicious ZIP archives via Google Forms posing as legitimate business or recruitment materials, often shared through LinkedIn or hosted on file-sharing services and URL shorteners.
Tools
Industries
EnergyThe lures use the names of well-known companies, particularly in the financial, logistic, technology, sustainability and energy sectors.financialare using malicious Google Forms linking to business-themed ZIP files (job interviews, project briefs, financial documents) to distribute a multi-stage infection chain that ultimately installs the PureHVNC .NET RAT.sustainabilityThe lures use the names of well-known companies, particularly in the financial, logistic, technology, sustainability and energy sectors.TechnologyThe lures use the names of well-known companies, particularly in the financial, logistic, technology, sustainability and energy sectors.