DesckVB RAT is a .NET-based remote access trojan distributed through a scalable, self-rebranding malspam kit that was first observed in the wild around February 2026 and remained active throughout 2026; Huntress SOC responded to a confirmed intrusion in May 2026. The campaign's defining tradecraft is its abuse of Google's legitimate DoubleClick Campaign Manager click-tracking infrastructure (ad.doubleclick.net) as the first redirect hop, lending the malicious link the reputation of a trusted Google-owned domain that most email security gateways will not block.

The infection begins with a phishing email carrying an HTML attachment (e.g., Bestellung_2026.html). When opened, the page meta-refresh redirects through ad.doubleclick.net and a chain of attacker redirectors (fostercareintheus.optimizationprime.com, bth.startthewave.org). The landing kit decodes the victim's Base64-encoded email address from the URL fragment via setupEmailAndUI(), then dynamically fetches the victim organization's logo through a fallback chain (Clearbit, logo.dev, Google favicons, favicone, DuckDuckGo, /favicon.ico) to personalize a fake 'Download PDF' lure on the fly. Because the kit holds no organization-specific content, swapping the email instantly rebrands the entire lure, making the operation trivially scalable.

Clicking the lure delivers a ZIP archive (A021185521S210008-11521.zip) containing an obfuscated JavaScript loader. The JS loader checks WScript.ScriptFullName; if running from Temp/Downloads it copies itself to C:\Users\Public\ktncm.js, relaunches under wscript.exe //nologo, and exits. On the second run from the stable location it repairs a base64 blob (mangled with literal 'A' characters and the token '9999') via the function vjwNvhDoHz(), decodes it to a PowerShell script written to C:\Users\Public\nlbzl.ps1, and runs it with powershell -ExecutionPolicy Bypass -file. The JS is padded with hundreds of dead functions, garbage Unicode, ;;;;; filler, and Portuguese-language comments.

The PowerShell stage fetches a fileless .NET loader DLL (the decoded 01.txt content) executed in memory via .NET reflection, abusing InstallUtil.exe as a LOLBin. The loader acts as a stager: it verifies it is not under analysis, neutralizes host security controls, sets up persistence, and downloads/executes the RAT via process hollowing. Process hollowing targets the Microsoft-signed binaries C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe and MSBuild.exe, using CreateProcessA (suspended), ZwUnmapViewOfSection, VirtualAllocEx, WriteProcessMemory, Get/SetThreadContext (and Wow64 variants), and ResumeThread. API names are hidden as base64 strings with '@' characters inserted at random positions, stripped and decoded at runtime for GetProcAddress resolution.

Defense evasion is extensive. On Windows 11 24H2+ (build 26100+) the loader patches AMSI by resolving NtManageHotPatch from ntdll.dll and overwriting its prologue to return STATUS_NOT_SUPPORTED (0xC00000BB). ETW is neutered on 64-bit systems by pattern-scanning ntdll.dll for the EtwEventWrite prologue and overwriting the entry point with xor rax,rax; ret using VirtualProtectEx/WriteProcessMemory/FlushInstructionCache. Microsoft Defender is disabled via PowerShell (real-time monitoring, IPS, MAPS, sample submission) and the entire system drive plus RAT install paths/process names are added as Defender exclusions. The stager performs aggressive sandbox/analysis-tool detection (VirtualBox, VMware, Hyper-V, Parallels, QEMU, Sandboxie/SbieDll.dll, Azure/RDP indicators, BIOS registry checks, and a process/window-title blocklist including Wireshark, OllyDbg, ImmunityDebugger, any.run, joeboxserver, triage). On detection it drops a marker file (vm.txt, Debugger.txt, or 01_detect_analisse_process.txt), deletes it, and reboots via Restart-Computer -Force; a Test-Connection www.google.com check forces a reboot when offline.

Persistence is established through HKCU Run and RunOnce keys named 'Update Drivers NVIDEO_<random>', a Startup-folder loader, and scheduled tasks created via schtasks /Create /XML with both a one-shot 5-second trigger and a persistent task repeating every 8-11 minutes (PT{8-11}M), at HighestAvailable or LeastPrivilege depending on token. The RAT installs as a randomly-named .exe in LocalApplicationData inside a deeply nested staging directory under %USERPROFILE%\AppData\LocalLow.

The RAT performs system reconnaissance via WMI (Win32_Processor, Win32_DiskDrive, Win32_BaseBoard, Win32_VideoController, Win32_OperatingSystem), fingerprints NVIDIA/AMD GPUs, and enumerates antivirus via the SecurityCenter2 AntivirusProduct class (terminating Qihoo 360 QHActiveDefense if present). C2 uses raw TCP sockets carrying AES-encrypted, protobuf-serialized messages with RSA for initial key exchange, certificate pinning against five hardcoded SHA-256 thumbprints, a hardcoded IE8 User-Agent, and DDNS C2 endpoints (xtadts.ddns.net, afxwd.ddns.net; a related sample used manikandan83.mysynology.net:7535) on non-standard ports for rapid infrastructure rotation. AES traffic is keyed from password P@55w0rd! via PBKDF2 (RFC2898DeriveBytes); an embedded resource is TripleDES-decrypted (CBC/PKCS7). The RAT supports command execution, data exfiltration, additional payload deployment, and keylogging. Attribution is unknown; Portuguese-language artifacts and Brazilian hosting (meusitehostgator.com.br) suggest a possible Brazilian/Portuguese-speaking operator. Reported by Huntress researchers Anna Pham and Adam Mooney.