New DesckVB RAT Unveiled with Multi-Stage Infection Chain and Plugin-Based Architecture
A recently discovered variant of the DeskVB Remote Access Trojan (RAT) demonstrates a highly modular architecture and a complex, multi-stage infection process. Although the malware family is not entirely new, the latest version (v2.9.0.0) is notable for…
A recently discovered variant of the DeskVB Remote Access Trojan (RAT) demonstrates a highly modular architecture and a complex, multi-stage infection process. Although the malware family is not entirely new, the latest version (v2.9.0.0) is notable for its operational stability and plugin-based design, allowing attackers to selectively deploy capabilities post-compromise.
The malware employs a fileless execution strategy to evade traditional antivirus detection, initiating with a Windows Script Host (WSH) JavaScript file. The initial payload is heavily obfuscated and, upon execution, replicates itself to C:\Users\Public\ , relaunches using wscript.exe , and constructs a PowerShell payload dynamically.
Subsequent stages involve PowerShell scripts for connectivity checks and anti-analysis scans to detect debugging environments. Once the environment is verified as safe, the script downloads decimal-encoded payload chunks and reconstructs a .NET assembly in memory. The final stage utilizes a .NET loader to execute the main RAT payload through Assembly.Load() , ensuring the malicious Portable Executable (PE) is not written to disk.
The DesckVB RAT decrypts its Command and Control (C2) configuration at runtime, revealing host IP, port, mutex, and capability flags. Communication is conducted via a custom TCP protocol. Although the C2 infrastructure was inactive during the analysis, the protocol was reconstructed using historical data. This communication relies on consistent delimiters and terminators, aiding network-level detection.
The malware employs a fileless execution strategy to evade traditional antivirus detection, initiating with a Windows Script Host (WSH) JavaScript file.
DesckVB's strength lies in its modularity, fetching DLLs from the C2 server as needed. The command RunBlugin||<BASE64_ENCODED_DLL> is used to retrieve these modules.
DetectarAntivirus.dll: Enumerates installed security products. Keylogger.dll: Implements low-level keyboard hooking. Webcam.dll: Streams JPEG frames using the AForge library. Ping_Net.dll: Performs ICMP probes and can execute HTTP(S) requests.
Analysis of a cracked v2.6 builder confirmed continuity in configuration structure with live v2.9 samples. Metadata such as "Pjoao1578" frequently appears, suggesting a shared toolchain or build environment. This information aids in threat clustering.
Stage 1 JS: 9d9cfe5b31a3b020e3c65d440d8355e33f7c056b087ec6aba3093ae1a099ac0 PowerShell Script: 347621f7a3392939d9bdbe8a6c9fda30ba9d3f23cb6733484da8e2993772b7f3 Loader: a675f5a396de1fa732a9d83993884b397f02921bbcf34346fbed32c8f4053064 RAT Payload: affb29980bc9564f1b03fe977e9ca5c7adf254656d639632c4d14e34aa4fdff6 Webcam Plugin: ff051dde71487ea459899920ef7014dad8eee4df308eb360555f3e22232c9367
C2 Address: manikandan83[.]mysynology[.]net:7535 Staging URL: hxxps://andrefelipedonascime1768785037020[.]1552093[.]meusitehostgator[.]com[.]br/.../01.txt Staging URL: .../02.txt Staging URL: .../03.txt Staging URL: .../PeYes
Based on reporting by GBHackers.