7 minhigh
HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures
Custom HVNC backdoor targets LATAM banking sector via fake DocuSign and NFe tax lures, delivering persistent remote control, keystroke monitoring, and Firefox credential theft through a four-stage infection chain. The four-stage chain uses anti-bot phishing pages to deliver ZIP archives containing disguised LNK shortcuts. These launch hidden PowerShell downloaders that fetch an NSIS installer bundling a 177 KB backdoor among 22 MB of legitimate DLLs. The payload establishes Startup-folder persistence, checks for 20+ AV processes, and beacons to C2 over raw TCP using a self-identified HVNC protocol with plaintext victim fingerprinting.
Sens:■ Immediate
IOCs20
5sha2563domain3file path3ip3url2md51mutex
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Block 5.230.249.49 and 40.124.169.27 on firewall, proxy, and DNS
- Hunt for AppUpdateHelper.lnk in Startup folders across all endpoints
- Search for processes named UpdateAssistant.exe running outside legitimate Windows paths
- Block receitafederal.digital and gerenciadorcaixa.digital at DNS resolver
Key Takeaways
- C2 IP is XOR-encoded with byte 0x37; port 27015 mimics Source-engine game traffic for netflow blending.
- Malware checks 20+ AV/EDR process names via Toolhelp32 and reports results to operator in handshake.
- Builder machine NetBIOS name 'servee' embedded in LNK metadata matches Azure staging server.
- VERSION:1.2.0.4.71 protocol string and k= delivery tokens are durable detection pivots across builds.
- Mutex prefixes Global\AppUpdateHelper_ and Global\WinSvc_ are stable across builds dating to March 2026.
Attack Chain
- Initial Access: Fake DocuSign/NFe phishing page with anti-bot checks serves per-visitor ZIP archive
- Execution: LNK shortcut disguised as tax receipt runs hidden PowerShell downloader
- Staging: PowerShell downloads NSIS installer from Azure staging IP via Invoke-WebRequest
- Installation: NSIS drops UpdateAssistant.exe among 22 MB of legitimate DLLs as camouflage
- Persistence: Payload copies itself to %APPDATA% and creates Startup folder shortcut
- C2: Backdoor beacons to C2 over raw TCP with plaintext HVNC protocol handshake and victim fingerprint
Affected Systems
- Windows 10/11 64-bit endpoints
- Firefox browser users (cookie and history theft)
- Banking and financial services in Latin America
- Finance, accounting, and procurement user roles
Detection Availability
- Published: YARA, Snort/Suricata
- Platforms: ANY.RUN blog IOC section
YARA rule for final payload and Suricata rule for HVNC C2 handshake provided in article IOC section.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | High | Process creation, file drops, Startup folder writes, and API calls (CreateDesktopA, SendInput) are all EDR-visible. |
| Network Visibility | Medium | Raw TCP on gaming port blends with consumer traffic; content inspection needed for HVNC protocol strings. |
| Detection Difficulty | Moderate | Behavioral signals are clear but XOR encoding, legitimate DLL camouflage, and gaming-port C2 add complexity. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Hunt for unsigned executables calling CreateDesktopA and SetThreadDesktop alongside SendInput APIs (T1219, T1113). | EDR API call telemetry | Command and Control | Low — legitimate remote tools rarely combine hidden desktop with input injection |
| Hunt for processes writing .lnk files to the Startup folder pointing to executables under %APPDATA% (T1547.001). | File system write events | Persistence | Low — legitimate installers rarely use this path pattern |
| Hunt for raw TCP connections containing HVNC- and VERSION:1.2.0.4.71 strings in payload (T1095, T1571). | Network content inspection or IDS alerts | Command and Control | Low — protocol strings are unique to this malware family |
Required Log Sources
- Process creation events (Sysmon EID 1)
- File system write events (Sysmon EID 11)
- PowerShell script block logs (EID 4104)
- Network connection logs (Sysmon EID 3)
- Startup folder file write events
- IDS/IPS network content inspection
Key Behavioral Indicators
- Unsigned process named UpdateAssistant.exe or AppUpdateHelper.exe outside Windows directories
- PowerShell launched from .lnk with -WindowStyle Hidden -ExecutionPolicy Bypass
- Process creating hidden desktop via CreateDesktopA/SetThreadDesktop APIs
- .lnk file written to Startup folder targeting %APPDATA% executable
- Raw TCP connection to port 27015/27017 with HVNC- protocol banner
- Mutex creation matching Global\AppUpdateHelper_* or Global\WinSvc_* pattern
Control Gaps
- Static hash blocklists miss payload rotation across builds
- Gaming-port TCP traffic may not trigger standard network alerts
- Legitimate DLL camouflage evades size-based suspicious file detection
- Anti-bot checks on phishing page bypass automated URL scanners
False Positive Assessment
Low — HVNC protocol strings, mutex patterns, and XOR-encoded C2 configuration are unique to this malware family. Startup-folder persistence pointing to %APPDATA% executables is rare in legitimate software.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Block outbound TCP 27015/27017 to non-gaming infrastructure segments
- Deploy IDS rules matching HVNC- and VERSION:1.2.0.4.71 protocol strings at perimeter
- Enable PowerShell script block logging on all Windows endpoints
- Restrict execution of unsigned binaries from %APPDATA% paths via AppLocker or WDAC
User Protection
- Deploy EDR rules alerting on hidden PowerShell launched from .lnk files
- Configure email filtering to quarantine .nfe and unexpected .zip attachments from external senders
- Enable browser isolation for finance and accounting teams accessing banking portals
- If EDR supports script content inspection, alert on Invoke-WebRequest in hidden PowerShell sessions
Security Awareness
- Train finance and accounting staff to verify DocuSign requests through separate channels
- Instruct employees to report unexpected NFe tax document downloads to security team
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping18 techniques
Tactic
Reconnaissance
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Stealth
Tactic
Credential Access
Tactic
Collection
Plain-Language Summary
Criminals are sending fake tax documents and DocuSign notifications to Latin American banks to infect computers with a hidden remote-control program. The malware disguises itself as a Windows update tool, survives reboots, steals Firefox browser data, and records keystrokes. Financial sector employees should verify unexpected signing requests and tax documents before opening them. Organizations should block the listed malicious addresses and hunt for the described behaviors rather than relying on file hashes alone.
Additional IOCs
- Domains:
aapj[.]digital- Banco do Brasil PJ phishing clone (co-hosted)
- Urls:
hxxp://5[.]230[.]249[.]49/dl.php?f=cresol.exe&k=chave_tecl_cresol- Additional stage-2 delivery, Cresol-themed lure varianthxxp://5[.]230[.]249[.]49/dl.php?f=payed.exe- Additional stage-2 delivery, generic-themed lure variant
- File Hashes:
e4d637f884f5babea6525266e1cb6ab332a16a446d6084dd51b4222540c1f16c(SHA256) - ZIP dropper build 1 (Samsung decoy)97f35ba586fc121590c867b4d6707777fbeca2ace5ad077807ec806540bb47cd(SHA256) - ZIP dropper build 2 (Motorola decoy)25db85830d86cafbb93a660242f8b4017273cc4612e94dd7a8af29c948651bbe(SHA256) - Persistence shortcut AppUpdateHelper.lnk9c2df9a72b0feeb0b166f0e4ab680851(MD5) - AppUpdateHelper.exe persistence copy (build 2)ad85e091181a7f299936c1241023e4f5(MD5) - AppUpdateHelper.lnk persistence shortcut (build 2)
- File Paths:
%APPDATA%\Roaming\Programs\Common\AppUpdateHelper.exe- Persistence copy of final payload%APPDATA%\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AppUpdateHelper.lnk- Startup folder persistence shortcut%USERPROFILE%\Desktop\%USERNAME%.exe- Stage-3 drop path pattern (dynamic per victim)
- Command Lines:
- Purpose: Download and execute second-stage binary via hidden PowerShell from LNK | Tools:
powershell.exe| Stage: Execution - Purpose: Force victim browser to open operator-supplied URL for redirection | Tools:
cmd.exe,chrome.exe,msedge.exe| Stage: Collection |cmd.exe /c start <browser>.exe <url>
- Purpose: Download and execute second-stage binary via hidden PowerShell from LNK | Tools:
- Other:
Global\WinSvc_4CF8B2E6- Runtime mutex from prior builds (stable prefix)0a4b2aff1c2ebf8b- Phishing kit build marker in DocuSign lure HTMLnfe_valid_access_key_2026_secure- Delivery server access token gating staging hostchave_tecl_cresol- Delivery server access token for Cresol lure variantVERSION:1.2.0.4.71- Durable HVNC protocol version string in C2 handshake
Showing defanged values
- domainaapj[.]digitalBanco do Brasil PJ phishing clone (co-hosted)
- domaingerenciadorcaixa[.]digitalCaixa Econômica Federal banking phishing clone
- domainreceitafederal[.]digitalNFe-themed phishing delivery domain
- file_path%APPDATA%\Roaming\Microsoft\Windows\StartMenu\Programs\Startup\AppUpdateHelper.lnkStartup folder persistence shortcut
- file_path%APPDATA%\Roaming\Programs\Common\AppUpdateHelper.exePersistence copy of final payload
- file_path%USERPROFILE%\Desktop\%USERNAME%.exeStage-3 drop path pattern (dynamic per victim)
- ip40[.]124[.]169[.]27Stage-2 payload staging server on Azure
- ip5[.]230[.]249[.]49Primary C2 server for HVNC backdoor (GHOSTnet Frankfurt)
- ip5[.]230[.]54[.]41Secondary delivery and co-hosted phishing server
- md59c2df9a72b0feeb0b166f0e4ab680851AppUpdateHelper.exe persistence copy (build 2)
- md5ad85e091181a7f299936c1241023e4f5AppUpdateHelper.lnk persistence shortcut (build 2)
- mutexGlobal\AppUpdateHelper_E7A2FStable mutex prefix across HVNC builds
- sha25625db85830d86cafbb93a660242f8b4017273cc4612e94dd7a8af29c948651bbePersistence shortcut AppUpdateHelper.lnk
- sha2565fbfc7929858c3c3d79637db857525695db3c0f41b9bf2a7b964c26b7226bde3Final HVNC payload build 1 (UpdateAssistant.exe)
- sha25697f35ba586fc121590c867b4d6707777fbeca2ace5ad077807ec806540bb47cdZIP dropper build 2 (Motorola decoy)
- sha256debf48e690abd4288e5f76fa7e9f98a9fb3411171eba82906ef0d2bf1ef2dd6dFinal HVNC payload build 2 (AppUpdateHelper.exe)
- sha256e4d637f884f5babea6525266e1cb6ab332a16a446d6084dd51b4222540c1f16cZIP dropper build 1 (Samsung decoy)
- urlhxxp://40[.]124[.]169[.]27/dl[.]php?f=NotaFiscal13242132334442026[.]exe&k=nfe_valid_access_key_2026_secureStage-2 delivery URL with static access token
- urlhxxp://5[.]230[.]249[.]49/dl[.]php?f=cresol[.]exe&k=chave_tecl_cresolAdditional stage-2 delivery, Cresol-themed lure variant
- urlhxxp://5[.]230[.]249[.]49/dl[.]php?f=payed[.]exeAdditional stage-2 delivery, generic-themed lure variant
Stay currentSubscribe via RSS
