Loading malware…
LOBSHOT is a Windows hidden virtual network computing (hVNC) remote-access trojan and information stealer active since at least July 2022. It has been distributed through malvertising campaigns in which fraudulent software-download sites and malicious installers impersonate legitimate applications. The malware performs host reconnaissance, including collection of system, user, display, process, desktop, and virtualization-related information, and searches Chrome, Edge, and Firefox for installed cryptocurrency-wallet extensions. LOBSHOT establishes user-level persistence, relocates itself to obscure execution ancestry, dynamically resolves Windows APIs, and includes checks intended to avoid Microsoft Defender emulation environments. Its hVNC component creates a separate hidden Windows desktop on which it can launch processes and browsers, capture the display, execute commands, simulate keyboard and mouse input, and manipulate clipboard content without visible interaction on the victim’s normal desktop. LOBSHOT has been used in financially motivated intrusions, including activity attributed to Hive0117, and has also been observed as a payload delivered by CastleLoader campaigns.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
In one analyzed attack, FMVT RAT also downloaded LOBSHOT, a RAT with HVNC support that enables covert control of a separate virtual desktop on the infected machine.
"LOBSHOT appears to be leveraged for financial purposes employing banking trojan and info-stealing capabilities" and its core capability is an hVNC module providing stealthy remote control.
20 distinct techniques documented for this family, organized by ATT&CK tactic.
An obfuscated PowerShell stager was uploaded to VirusTotal on June 18, 2026. The Urutyka campaign follows CastleLoader’s established infection chain... The obfuscated PowerShell stager unpacks a second PS1 script and contacts the download server...
The landing pages were very convincing with similar branding as the legitimate software and included Download Now buttons that pointed to an MSI installer.
It sets Registry key data under the Software\Microsoft\Windows NT\CurrentVersion\Devices key path ... [and] manages [C2 replacement] by writing the new C2 details ... under the Video value.
For persistence, LOBSHOT leverages the Registry run key persistence method ... in the HKEY_CURRENT_USER Registry hive with a randomly generated name pointing to the malware located in C:\ProgramData.
For persistence, LOBSHOT leverages the Registry run key persistence method ... in the HKEY_CURRENT_USER Registry hive with a randomly generated name pointing to the malware located in C:\ProgramData.
This malware hides its primary strings through a straightforward encryption function using different bitwise operators.
It employs dynamic import resolution to evade security products and slow down the rapid identification of its capabilities.
Attackers promoted their malware using an elaborate scheme of fake websites through Google Ads and embedding backdoors in what appears to users as legitimate installers.
After LOBSHOT is executed, it moves a copy of itself to the C:\ProgramData folder, spawning a new process using explorer.exe, terminating the original process, and finally deleting the original file.
If this file exists it will be executed with rundll32.exe with the following command-line arguments: rundll32.exe "C:\ProgramData\hmr_1.dat", #1 hmod.
LOBSHOT performs a Windows Defender anti-emulation check by verifying if the computer name matches the string HAL9TH and if the username matches JohnDoe.
It sets Registry key data under the Software\Microsoft\Windows NT\CurrentVersion\Devices key path ... [and] manages [C2 replacement] by writing the new C2 details ... under the Video value.
LOBSHOT builds a custom structure containing enumerated data from the machine including ... username, computer name.
LOBSHOT builds a custom structure containing enumerated data ... number of processes running, process ID, parent process of malware.
LOBSHOT builds a custom structure containing enumerated data from the machine including GUID of machine, Windows edition, computer name, display device information, and screen height/width.
LOBSHOT performs a Windows Defender anti-emulation check by verifying if the computer name matches the string HAL9TH and if the username matches JohnDoe.
LOBSHOT implements the hVNC feature by generating a hidden desktop using the CreateDesktopW Windows API ... The attacker interacts with the client by controlling the keyboard, clicking buttons, and moving the mouse.
It starts by targeting specific Google Chrome extensions that deal with cryptocurrency wallets ... trying to access 32 Chrome wallet extensions, nine Edge wallet extensions, and 11 Firefox wallet extensions.
The victim machine will start sending screen captures that represent the hidden desktop that is sent to a listening client controlled by the attacker.
Within LOBSHOT’s hVNC module, there is a built-in GUI menu that allows the attacker to ... Set/retrieve Clipboard text.
For each LOBSHOT sample ... there is a hardcoded IP and port ... used as the primary C2. The malware beacons every 5 seconds ... [using] socket, connect, send, select, recv.
FMVT RAT ... способен выполнять команды своих операторов, скачивать дополнительные пейлоады... В одной из изученных атак через FMVT RAT также загрузили LOBSHOT.
After this initial handshake, LOBSHOT will send the previous custom data structure containing the enumerated data such as the hostname, username, windows objects, etc. over this port.
45 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.