# Elastic Security Labs discovers the LOBSHOT malware

LOBSHOT malware spread via fake Google Ads installers, using hVNC hidden desktops and wallet-extension enumeration to give attackers stealthy full remote control and crypto theft.

- Payout: Real-world hack
- Program: LOBSHOT
- Analysis by: Daniel Stepanic
- Disclosed: 2023-05-16
- Write-up quality: 7/10
- Original: https://www.elastic.co/security-labs/threat-command/elastic-security-labs-discovers-lobshot-malware
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-elastic-security-labs-discovers-lobshot-malware
- Tags: area:web3 domain:desktop domain:web3 impact:ato impact:data-leak kind:incident platform:threat-intel tech:windows technique:recon technique:reverse-engineering vuln:info-disclosure vuln:secrets-leak

**Target:** Windows endpoints via fake software installers (MSI) and browser wallet extensions
**Root cause:** Malware masquerades as legitimate installers promoted through Google Ads; once run it copies itself to ProgramData, breaks process ancestry, persists via Run key, and spawns a hidden desktop (CreateDesktopW/SetThreadDesktop) for unobserved remote control.
**Steps:**
1. Lure victim via Google Ad pointing to typosquat domain e.g. `https://www.amydecke[.]website` instead of anydesk.com
2. Landing page's Download Now serves an MSI installer that drops LOBSHOT DLL/EXE
3. LOBSHOT resolves Windows APIs dynamically via LoadLibraryA/GetProcAddress
4. Anti-emulation check: exits if computer name is `HAL9TH` and username `JohnDoe`
5. Decrypts strings using seed from WTSEnumerateSessionsA (XOR of SessionID 0 and 'S' from 'Services')
6. Copies itself to `C:\ProgramData`, spawns via explorer.exe, terminates and deletes original to break process tree
7. Persistence via HKCU Run key with random name; sets `Software\Microsoft\Windows NT\CurrentVersion\Devices` Display value `134a1160` as infection marker
8. Stealer enumerates 32 Chrome, 9 Edge, 11 Firefox crypto wallet extension IDs, writes matches (e.g. `Chrome_Yoroi`) to Default Printer value
9. Checks for `C:\ProgramData\hmr_*.dat` and executes via `rundll32.exe "C:\ProgramData\hmr_1.dat", #1 hmod`
10. Beacons every 5s to hardcoded C2 IP/port via ws2_32 socket/connect/send/select/recv, sending hardcoded data, shortened GUID and version number
11. hVNC: CreateDesktopW hidden desktop, SetThreadDesktop, spawn explorer.exe on it, stream screen captures to attacker client with keyboard/mouse control
**How found:** Researchers noticed a spike in malvertising and traced infections from fake AnyDesk ads to an unknown hVNC malware; analyzed samples (500+ since July 2022) via Qiling emulation, Procmon, and Wireshark, and pivoted on hardcoded bytes `C7 06 25 56 0A DC` in VirusTotal VTGrep to find 550+ related samples.
**Exploitation:** Attacker runs hVNC GUI menu on hidden desktop to launch processes, run CMD, manipulate clipboard, start browsers, and modify DPI/sound — full interactive control invisible to victim; C2 can be swapped via registry Video value; update mechanism removes persistence and respawns.
**Escalation:** hVNC bypasses fraud/device detection; wallet extension enumeration plus clipboard grabber enables crypto theft; hmr_*.dat allows loading additional attacker DLLs.
**Insight:** Hardcoded request-buffer bytes (e.g. the mov instruction plus first DWORD) are a strong pivot for clustering and dating a malware family in VirusTotal VTGrep; also, checking for Defender emulation artifacts like HAL9TH/JohnDoe reveals sandbox-evasion logic worth replicating in detections.

## Proof of concept (copied exactly from the original report)

**rundll32 execution of hmr_*.dat payload**

```
rundll32.exe "C:\ProgramData\hmr_1.dat", #1 hmod
```

**EQL query detecting LOBSHOT process tree**

```
sequence by host.id, user.id with maxspan=1m
 [process where event.type == "start" and not startsWith~(process.executable, process.parent.executable)] by process.parent.name, process.entity\_id
 [file where event.type == "deletion"] by file.name, process.entity\_id
 [process where event.type == "start" and not startsWith~(process.executable, process.parent.executable)] by process.name, process.parent.entity\_id
until [process where event.type == "end"] by process.name, process.entity\_id
```

**YARA rule for LOBSHOT detection**

```
rule Windows_Trojan_Lobshot {
 meta:
 author = "Elastic Security"
 creation_date = "2023-04-18"
 last_modified = "2023-04-18"
 license = "Elastic License v2"
 os = "Windows"
 threat_name = "Windows.Trojan.Lobshot"
 reference_sample = "e4ea88887753a936eaf3361dcc00380b88b0c210dcbde24f8f7ce27991856bf6"
 strings:
 $str0 = "HVNC Remote Control" ascii fullword
 $str1 = " Error # %d - %08lx" ascii fullword
 $str2 = "Set clipboard text failed." ascii fullword
 $str3 = "OK %08lx %08lx %d" ascii fullword
 $str4 = "\") & (rundll32.exe \"" wide fullword
 $str5 = "%LOCALAPPDATA%\\svc.db" wide fullword
 $str6 = "cmd.exe /c (ping -n 10 127.0.0.1) & (del /F /Q \"" wide fullword
 $seq_str_decrypt = { 8A 5A ?? 8D 52 ?? 80 EB ?? 85 FF 74 ?? C0 E0 ?? 2C ?? 0A C3 32 C1 32 C7 88 06 32 E8 83 C6 ?? 83 C5 ?? EB ?? }
 $seq_emu_check = { 8B 35 ?? ?? ?? ?? 8D 44 24 ?? 50 8D 44 24 ?? C7 44 24 ?? 48 41 4C 39 50 C7 44 24 ?? 54 48 00 00 FF D6 }
 $seq_enum_xor = { FF 15 ?? ?? ?? ?? 84 C0 0F 84 ?? ?? ?? ?? 83 7C 24 ?? 00 0F 84 ?? ?? ?? ?? 8B 4C 24 ?? 68 07 80 00 00 8B 41 ?? 8A 00 32 01 A2 ?? ?? ?? ?? }
 $seq_create_guid = { 8D 48 ?? 80 F9 ?? 77 ?? 2C ?? C1 E2 ?? 46 0F B6 C8 0B D1 83 FE ?? 7C ?? 5F 8B C2 5E C3 }
 condition:
 2 of ($seq*) or 5 of ($str*)
}
```