Skip to content
MalwareWiki

Malware

HATVIBE

According to Sekoia, the aim of this backdoor is to receive VBS modules for execution from a remote C2 server.

HATVIBE is a VBScript malware family operated by UAC-0063.

Background

Per Sekoia, this backdoor exists to pull VBS modules down from a remote C2 server and run them. After fetching a module, HATVIBE decrypts it with a basic XOR routine, wraps it inside a pair of <script> tags, and inserts it into the HTML body of the HTA file, which causes the received module to execute automatically.

Source: Malpedia (Fraunhofer FKIE).