Hidden Windows desktops, a legitimate feature often leveraged by specialized software, are increasingly being exploited by malicious actors. The MedusaHVNC malware, a remote access trojan (RAT), operates in this manner, utilizing hidden desktops to remain undetected by users.
Introduction to MedusaHVNC
MedusaHVNC, marketed as malware-as-a-service (MaaS), is actively promoted through its dedicated website and Telegram channel. Cybersecurity firm BlackFog has conducted an analysis revealing that the malware incorporates a hidden virtual network computing (HVNC) module. This module initiates a legitimate web browser on a concealed Windows desktop, ensuring its activity remains unseen by the user.
The malware employs a sophisticated five-stage infection process. Initially, the legitimate Windows script engine, wscript.exe, executes a JScript launcher. Following a brief pause, the script constructs its embedded files in the location %TEMP%Nx2981Okkr2, proceeding to write several files to disk, including an encrypted payload and a batch file placed in the Startup folder to ensure persistence.
Technical Breakdown of the Infection Chain
To decrypt the payload, MedusaHVNC utilizes Windows AutoIT, subsequently initiating charmap.exe, the Windows character map utility. Within charmap.exe, the payload undergoes two additional layers of encryption. The initial layer involves a 16-byte repeating XOR operation across 1,009,152 bytes from the .data section, followed by the ChaCha20 encryption, which decrypts 998,912 bytes of ciphertext using a 32-byte key, a 12-byte nonce, and an initial counter value of 1.
The final payload comprises an unsigned PE32+ x86-64 console executable, featuring a .pay section and the MedusaHVNC family string. It establishes communication with the attacker’s command and control (C2) server at a hardcoded IP address, 51.89.204.28:4444.
Capabilities and Implications of MedusaHVNC
Within this hidden desktop environment, attackers can create browsers using Chrome, Edge, or Firefox. The malware leverages legitimate Windows functions, such as BitBlt, EnumWindows, and PrintWindow, to capture screens and windows, coupled with SendInput and SetWindowsHookExW for synthetic input and interaction.
Additionally, the malware utilizes clipboard functions like OpenClipboard, GetClipboardData, and SetClipboardData to facilitate data transfer during sessions. This hidden desktop feature enables attackers to fully exploit Windows tools without being detected by the user, maintaining a stealthy and persistent presence.
Mitigation and Detection
Despite its covert operations, the only apparent mitigation involves monitoring for unexpected data exfiltration. Although the RAT’s activities are obscured within the hidden desktop, data must still be extracted from the network. Detecting unexplained data leaving the network serves as a crucial indicator of potential security breaches.
In conclusion, MedusaHVNC represents a significant threat due to its ability to utilize legitimate Windows capabilities for malicious purposes. Continuous vigilance and network monitoring are essential in identifying and mitigating such threats.
