Analysis Finds PureHVNC RAT Behind Disguised PowerShell Loader, Little Evidence of TeamPCP Link
Summary
Analysis of a file disguised as an MP3 found an obfuscated PowerShell loader delivering a stealer and PureHVNC RAT. The author assesses TeamPCP attribution as low confidence, citing no shared infrastructure or tooling.
Key points
- The file oqqqqoa.mp3 is described as a heavily obfuscated PowerShell script that downloads and executes additional malware.
- Dynamic analysis observed a .NET payload, a PureHVNC component, and traffic to separate distribution and command-and-control servers.
- The malware was observed uploading about 65 KB of data and downloading about 616 KB of commands or modules.
- Reported collection targets include browser credentials, cryptocurrency wallet files, VPN configurations, and system information.
- PureHVNC provides hidden remote desktop access; the analysis also reports attempts to disable Windows tracing and establish persistence.
- The author rates TeamPCP attribution as low confidence, citing differences in delivery, tooling, infrastructure, and targets.
Article Details
- Attack Vectors
- A file named oqqqqoa.mp3 masqueraded as an audio file but contained an obfuscated PowerShell script; the article says victims could be induced to execute it directly or Windows could execute it if .mp3 files were configured to open with PowerShell.
- The PowerShell loader downloaded and executed MidwestGrey.exe from the distribution server.
- The malware used a two-tier C2 setup: a distribution server for secondary payloads and a separate PUREHVNC C2 server for commands, remote control, and data theft.
- The malware targeted browser credentials, cryptocurrency wallet files, VPN configurations, and system information, and established hidden VNC remote access.
- Defensive Notes
- The article identifies 46.151.182.216 as the active PUREHVNC C2 and 43.228.157.123 as the payload distribution server, and recommends blocking both.
- Monitor for the listed file hashes, filenames, and the RegAsm_RASAPI32 registry path and tracing-value changes described in the article.
- The loader uses layered obfuscation, including base64-encoded chunks, character-array obfuscation, and RC4-encrypted configuration; the article notes that decoded chunks are joined and decoded in memory.
- The article assesses TeamPCP attribution as low confidence and says the campaign is almost certainly not TeamPCP.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | mzddgrrqkzoeud[.]mzddgrrqkzoeud | DGA-generated fallback C2 domain attempted by the malware; the article reports that resolution failed. |
| IPV4 | 43[.]228[.]157[.]123 | Distribution server used to deliver MidwestGrey.exe. |
| IPV4 | 46[.]151[.]182[.]216 | Active PUREHVNC C2 server observed exchanging commands and stolen data with RegAsm.exe. |
| MD5 | bdea1d91191344ff48fd20ddd8ecfe21 | MD5 of MidwestGrey.exe, the downloaded executable payload. |
| SHA256 | 72c08e044dd427964bc14339f95838e3d45f51f6a586330c683fbb59ea374b1d | SHA-256 of oqqqqoa.mp3, the disguised PowerShell loader. |
| SHA256 | 7b57628329827948fd8be903b028b4e619e59abe03dd1ab2dad0939be9707a10 | SHA-256 of MidwestGrey.exe, the downloaded executable payload. |
| URL | hxxp[:]//43[.]228[.]157[.]123/MidwestGrey.exe | Payload-download URL identified as the source of MidwestGrey.exe. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe loader uses variable-name obfuscation, base64-encoded payload chunks, character arrays, and RC4 encryption to conceal code and C2 configuration.T1041 · Exfiltration Over C2 ChannelDynamic analysis observed approximately 65 KB of stolen credentials and system data sent to the PUREHVNC C2.T1053.005 · Scheduled TaskMidwestGrey.exe invokes at.exe in an attempted persistence action; the displayed task is reported as invalid.T1056.001 · KeyloggingThe malware is reported to collect saved browser passwords and other browser credential data from Chrome, Edge, and Chromium-based browsers.T1057 · Process DiscoveryThe malware runs tasklist.exe to enumerate running processes.T1059.001 · PowerShellThe initial file oqqqqoa.mp3 is described as an obfuscated PowerShell script used as the loader.T1071.001 · Web ProtocolsThe PUREHVNC component communicates with its C2 over HTTPS/TLS.T1083 · File and Directory DiscoveryThe malware uses findstr.exe to search for files or strings, including in its collection activity.T1105 · Ingress Tool TransferThe PowerShell loader downloads MidwestGrey.exe from the distribution server, and the malware retrieves additional modules from its C2.T1112 · Modify RegistryRegAsm.exe modifies Windows tracing values under HKLM\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32.T1115 · Clipboard DataThe malware searches for cryptocurrency wallet files, including wallet.dat and keystore files.T1562.001 · Disable or Modify ToolsThe PUREHVNC component disables file, automatic, and console tracing to impair detection and forensic visibility.