MedusaHVNC RAT Uses Hidden Windows Desktops to Evade Detection
Summary
BlackFog analyzed MedusaHVNC, a RAT with a hidden virtual desktop module. Its five-stage infection chain decrypts a payload that uses legitimate Windows functions for covert browser interaction, screen capture, and clipboard access.
Key points
- BlackFog found a hidden virtual network computing (HVNC) module that opens Chrome, Edge, or Firefox on a separate Windows desktop.
- The reported five-stage infection chain begins when wscript.exe runs a JScript launcher, which writes embedded files under %TEMP%.
- A Startup-folder batch file provides persistence; AutoIt decrypts the payload and launches it through charmap.exe.
- The loader uses repeating XOR and ChaCha20 encryption layers, according to the researchers.
- The final payload communicates with a hardcoded C2 address, 51.89.204.28:4444.
- Windows functions including BitBlt, PrintWindow, SendInput, and clipboard APIs support covert screen capture and interaction.
- The article identifies unexplained outbound data as a potential detection opportunity.
Article Details
- Attack Vectors
- A JScript launcher is executed by wscript.exe and stages embedded files under %TEMP%\Nx2981Okkr2\.
- A .bat file is placed in the Startup folder for persistence; AutoIT decrypts the payload and starts charmap.exe.
- MedusaHVNC uses a hidden Windows desktop to operate a browser and interact with the session without the user seeing it.
- The malware communicates with a hardcoded operator C2 address.
- Defensive Notes
- The article identifies detection of unexplained data leaving the network as the obvious mitigation.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 51[.]89[.]204[.]28 | Hardcoded operator C2 address for MedusaHVNC; the article gives port 4444. |
MITRE ATT&CK
T1059.007 · JavaScriptThe infection chain starts when wscript.exe executes a JScript launcher.T1059.010 · AutoHotKey & AutoITAutoIT decrypts the payload and starts charmap.exe.T1113 · Screen CaptureThe malware uses Windows functions including BitBlt, EnumWindows, and PrintWindow for screen and window capture.T1115 · Clipboard DataThe researchers say clipboard functions are used to move information into or out of the hidden session.T1140 · Deobfuscate/Decode Files or InformationAutoIT decrypts the payload, and the loader applies XOR and ChaCha20 decryption layers.T1547.001 · Registry Run Keys / Startup FolderA .bat file is written to the Startup folder to maintain persistence.
Malware
Products
EdgeThe operator can create a browser of choice within the hidden desktop from Chrome, Edge, and Firefox.Google ChromeThe operator can create a browser of choice within the hidden desktop from Chrome, Edge, and Firefox.Microsoft WindowsHidden desktops are a legitimate Windows capability, often used by specialized software, and occasionally used by malware.Mozilla FirefoxThe operator can create a browser of choice within the hidden desktop from Chrome, Edge, and Firefox.