# DesckVB RAT — Google DoubleClick-Abusing Malspam Kit Delivers Fileless .NET Remote Access Trojan (Huntress)

> A malspam campaign active since February 2026 abuses Google's high-reputation DoubleClick Campaign Manager click-tracking domain (ad.doubleclick.net) to bypass email gateways before delivering DesckVB RAT, a fileless .NET remote access trojan. A self-personalizing malspam kit decodes the victim's Base64-encoded email from the URL fragment to dynamically brand the lure, then runs an HTML > JScript > PowerShell > .NET loader > RAT chain that performs process hollowing into Microsoft-signed InstallUtil.exe/MSBuild.exe, patches AMSI/ETW at the native API level, disables Microsoft Defender, and establishes AES/protobuf-over-raw-TCP C2.

- **Published:** 2026-06-04T00:00:00Z
- **Last reviewed:** 2026-06-04T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0681
- **ID:** TL-2026-0681
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

DesckVB RAT is a .NET-based remote access trojan distributed through a scalable, self-rebranding malspam kit that was first observed in the wild around February 2026 and remained active throughout 2026; Huntress SOC responded to a confirmed intrusion in May 2026. The campaign's defining tradecraft is its abuse of Google's legitimate DoubleClick Campaign Manager click-tracking infrastructure (ad.doubleclick.net) as the first redirect hop, lending the malicious link the reputation of a trusted Google-owned domain that most email security gateways will not block.

The infection begins with a phishing email carrying an HTML attachment (e.g., Bestellung_2026.html). When opened, the page meta-refresh redirects through ad.doubleclick.net and a chain of attacker redirectors (fostercareintheus.optimizationprime.com, bth.startthewave.org). The landing kit decodes the victim's Base64-encoded email address from the URL fragment via setupEmailAndUI(), then dynamically fetches the victim organization's logo through a fallback chain (Clearbit, logo.dev, Google favicons, favicone, DuckDuckGo, /favicon.ico) to personalize a fake 'Download PDF' lure on the fly. Because the kit holds no organization-specific content, swapping the email instantly rebrands the entire lure, making the operation trivially scalable.

Clicking the lure delivers a ZIP archive (A021185521S210008-11521.zip) containing an obfuscated JavaScript loader. The JS loader checks WScript.ScriptFullName; if running from Temp/Downloads it copies itself to C:\Users\Public\ktncm.js, relaunches under wscript.exe //nologo, and exits. On the second run from the stable location it repairs a base64 blob (mangled with literal 'A' characters and the token '9999') via the function vjwNvhDoHz(), decodes it to a PowerShell script written to C:\Users\Public\nlbzl.ps1, and runs it with powershell -ExecutionPolicy Bypass -file. The JS is padded with hundreds of dead functions, garbage Unicode, ;;;;; filler, and Portuguese-language comments.

The PowerShell stage fetches a fileless .NET loader DLL (the decoded 01.txt content) executed in memory via .NET reflection, abusing InstallUtil.exe as a LOLBin. The loader acts as a stager: it verifies it is not under analysis, neutralizes host security controls, sets up persistence, and downloads/executes the RAT via process hollowing. Process hollowing targets the Microsoft-signed binaries C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe and MSBuild.exe, using CreateProcessA (suspended), ZwUnmapViewOfSection, VirtualAllocEx, WriteProcessMemory, Get/SetThreadContext (and Wow64 variants), and ResumeThread. API names are hidden as base64 strings with '@' characters inserted at random positions, stripped and decoded at runtime for GetProcAddress resolution.

Defense evasion is extensive. On Windows 11 24H2+ (build 26100+) the loader patches AMSI by resolving NtManageHotPatch from ntdll.dll and overwriting its prologue to return STATUS_NOT_SUPPORTED (0xC00000BB). ETW is neutered on 64-bit systems by pattern-scanning ntdll.dll for the EtwEventWrite prologue and overwriting the entry point with xor rax,rax; ret using VirtualProtectEx/WriteProcessMemory/FlushInstructionCache. Microsoft Defender is disabled via PowerShell (real-time monitoring, IPS, MAPS, sample submission) and the entire system drive plus RAT install paths/process names are added as Defender exclusions. The stager performs aggressive sandbox/analysis-tool detection (VirtualBox, VMware, Hyper-V, Parallels, QEMU, Sandboxie/SbieDll.dll, Azure/RDP indicators, BIOS registry checks, and a process/window-title blocklist including Wireshark, OllyDbg, ImmunityDebugger, any.run, joeboxserver, triage). On detection it drops a marker file (vm.txt, Debugger.txt, or 01_detect_analisse_process.txt), deletes it, and reboots via Restart-Computer -Force; a Test-Connection www.google.com check forces a reboot when offline.

Persistence is established through HKCU Run and RunOnce keys named 'Update Drivers NVIDEO_<random>', a Startup-folder loader, and scheduled tasks created via schtasks /Create /XML with both a one-shot 5-second trigger and a persistent task repeating every 8-11 minutes (PT{8-11}M), at HighestAvailable or LeastPrivilege depending on token. The RAT installs as a randomly-named .exe in LocalApplicationData inside a deeply nested staging directory under %USERPROFILE%\AppData\LocalLow.

The RAT performs system reconnaissance via WMI (Win32_Processor, Win32_DiskDrive, Win32_BaseBoard, Win32_VideoController, Win32_OperatingSystem), fingerprints NVIDIA/AMD GPUs, and enumerates antivirus via the SecurityCenter2 AntivirusProduct class (terminating Qihoo 360 QHActiveDefense if present). C2 uses raw TCP sockets carrying AES-encrypted, protobuf-serialized messages with RSA for initial key exchange, certificate pinning against five hardcoded SHA-256 thumbprints, a hardcoded IE8 User-Agent, and DDNS C2 endpoints (xtadts.ddns.net, afxwd.ddns.net; a related sample used manikandan83.mysynology.net:7535) on non-standard ports for rapid infrastructure rotation. AES traffic is keyed from password P@55w0rd! via PBKDF2 (RFC2898DeriveBytes); an embedded resource is TripleDES-decrypted (CBC/PKCS7). The RAT supports command execution, data exfiltration, additional payload deployment, and keylogging. Attribution is unknown; Portuguese-language artifacts and Brazilian hosting (meusitehostgator.com.br) suggest a possible Brazilian/Portuguese-speaking operator. Reported by Huntress researchers Anna Pham and Adam Mooney.

## MITRE ATT&CK

- T1566 Phishing
- T1027 Obfuscated Files or Information
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1218 System Binary Proxy Execution
- T1620 Reflective Code Loading
- T1055 Process Injection
- T1685 Disable or Modify Tools
- T1497 Virtualization/Sandbox Evasion
- T1574 Hijack Execution Flow
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1548 Abuse Elevation Control Mechanism
- T1056 Input Capture
- T1082 System Information Discovery
- T1518 Software Discovery
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1573 Encrypted Channel
- T1568 Dynamic Resolution
- T1132 Data Encoding
- T1041 Exfiltration Over C2 Channel

## Sources

- [Inside DesckVB RAT Analysis: From Malspam to In-Memory RAT](https://www.huntress.com/blog/malspam-to-deskcvb-rat-delivery-chain-analysis)
- [Google DoubleClick Abused in New Malspam Campaign to Deliver DesckVB RAT](https://thehackernews.com/2026/06/google-doubleclick-abused-in-new.html)
- [DesckVB RAT: Fileless .NET Stealer via JS and PowerShell](https://socprime.com/active-threats/desckvb-rat-analysis/)
- [Abuse of Google DoubleClick to distribute DesckVB RAT](https://www.secnews.gr/en/713147/google-doubleclick-malspam-desckvb-rat/)
- [MITRE ATT&CK T1055.012 — Process Hollowing](https://attack.mitre.org/techniques/T1055/012/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0681