bridgeagent | file_ea7a051a82d4b3b5[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
file_ea7a051a82d4b3b5.exe
Size 6.4MB
Sample260916-precwsah77
SHA256 d49785f0195374536fa826a9f2228da105b80fa7bff5d8bee24c7260c665a09e
MD5 ea7aeeebfda6f39a868a6ba491695737
SHA1 01adc9b0769c2bcd81bac32d23ff9776c1a3eab4
SHA512 a233e07859d60c35c7831790547c913585dba9dcf9f82b965f3c9081f0e792f9af925e669ccdeb5b689f7f18df569f20c21e97285d4c17aa594f66692e499664
SSDEEP 98304:/HL3d0WMOPQ2p+COJx5C/YDX6XC7nKj54:7vBOoy
TLSH
T193663B11BA6B94BCD557C8B483068A239E2130DF1B26BAFF418486393F69BF11B3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor loader bridgeagent

Malware Config

Extracted

Family

bridgeagent

2.27.168.45

Signatures

Family: BridgeAgent,ShadowHVNC
BridgeAgent aka ShadowHVNC is a Windows backdoor and loader written in Rust.
backdoor loader bridgeagent

Detects BridgeAgent aka ShadowHVNC loader 1 IoCs

resource	yara_rule
sample	family_bridgeagent

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
file_ea7a051a82d4b3b5.exe

File Explorer

file_ea7a051a82d4b3b5.exe

.exe 6.4MB

file_ea7a051a82d4b3b5.exe

IMPHASH 091957ba6d998b6cb4666637b9c53b31
SHA256 d49785f0195374536fa826a9f2228da105b80fa7bff5d8bee24c7260c665a09e
MD5 ea7aeeebfda6f39a868a6ba491695737
SHA1 01adc9b0769c2bcd81bac32d23ff9776c1a3eab4
SHA512 a233e07859d60c35c7831790547c913585dba9dcf9f82b965f3c9081f0e792f9af925e669ccdeb5b689f7f18df569f20c21e97285d4c17aa594f66692e499664
SSDEEP 98304:/HL3d0WMOPQ2p+COJx5C/YDX6XC7nKj54:7vBOoy
TLSH
T193663B11BA6B94BCD557C8B483068A239E2130DF1B26BAFF418486393F69BF11B3D754
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects BridgeAgent aka ShadowHVNC loader
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5063980

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

IT_solutions.pdb

crypt32

CertFreeCertificateContext CertCloseStore CertDuplicateCertificateChain CertFreeCertificateChain CertDuplicateCertificateContext CertEnumCertificatesInStore CertDuplicateStore CertAddCertificateContextToStore CertGetCertificateChain CertVerifyCertificateChainPolicy CryptUnprotectData CryptProtectData CryptStringToBinaryA CertCreateCertificateContext CertOpenStore

kernel32

GetCurrentProcessId GetUserDefaultGeoName GetLocaleInfoEx MoveFileExW CreateToolhelp32Snapshot Process32NextW Process32FirstW SetFilePointerEx ProcessIdToSessionId GetCurrentThreadId WaitForSingleObject HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter GetSystemInfo GetProcessId GetExitCodeProcess GetLogicalDrives LocalFree OpenProcess GetProcessTimes QueryFullProcessImageNameW TerminateProcess CreateJobObjectW SetInformationJobObject FlushFileBuffers CreateMutexW AssignProcessToJobObject GetSystemTimePreciseAsFileTime CreatePipe SetHandleInformation CreatePseudoConsole InitializeProcThreadAttributeList UpdateProcThreadAttribute ClosePseudoConsole DeleteProcThreadAttributeList CreateProcessW ResumeThread ResizePseudoConsole WriteFile FindNextFileW GlobalSize GlobalLock GlobalUnlock GlobalAlloc GlobalFree CompareStringOrdinal GetTimeZoneInformationForYear AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetQueuedCompletionStatusEx GetOverlappedResult CreateIoCompletionPort SetFileCompletionNotificationModes SetLastError GetFinalPathNameByHandleW CancelIoEx CreateFileW GetModuleHandleW GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW WaitForSingleObjectEx LoadLibraryA GetCurrentProcess lstrlenW CreateMutexA WideCharToMultiByte ReadFile GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW WriteFileEx SleepEx ReadFileEx FormatMessageW GetModuleHandleA GetFullPathNameW SetFileTime SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW CreateEventW CancelIo GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW GetModuleFileNameW DuplicateHandle WaitForMultipleObjects GetCommandLineW RemoveDirectoryW DeleteFileW CopyFileExW CreateWaitableTimerExW SetWaitableTimer Sleep GetStringTypeW GetFileType SetStdHandle SetEnvironmentVariableW GetCPInfo GetOEMCP GetACP IsValidCodePage LCMapStringW CompareStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetTimeZoneInformation GetCommandLineA ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RtlPcToFileHeader RtlUnwindEx GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter PostQueuedCompletionStatus TerminateJobObject FindClose SwitchToThread CloseHandle GetLastError CreateThread HeapFree GetProcessHeap ReleaseMutex DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection RaiseException OutputDebugStringA OutputDebugStringW FormatMessageA SetFilePointer LockFile GetDiskFreeSpaceW HeapCreate AreFileApisANSI SetEndOfFile HeapValidate FreeLibrary UnlockFileEx GetFileSize GetTempPathA GetDiskFreeSpaceA SystemTimeToFileTime GetTickCount MapViewOfFile CreateFileMappingW LockFileEx GetSystemTime GetSystemTimeAsFileTime GetFileAttributesA GetFileAttributesExW GetFullPathNameA HeapSize FlushViewOfFile CreateFileA DeleteFileA LoadLibraryW HeapCompact HeapDestroy UnlockFile UnmapViewOfFile GetTempPathW

user32

GetClipboardSequenceNumber GetDC ReleaseDC ScreenToClient ChildWindowFromPointEx SetThreadDesktop CloseDesktop GetClassNameW IsWindow IsWindowVisible GetWindowRect EnumDesktopWindows SendInput MapVirtualKeyW GetKeyboardState GetDpiForWindow SetKeyboardState SetThreadDpiAwarenessContext OpenClipboard PrintWindow RegisterSuspendResumeNotification GetSystemMetrics CreateDesktopW PeekMessageW GetAncestor SendMessageTimeoutW IsClipboardFormatAvailable GetClipboardData GetWindowThreadProcessId AttachThreadInput GetThreadDesktop GetGUIThreadInfo PostMessageW CloseClipboard EmptyClipboard SetClipboardData OpenInputDesktop SetActiveWindow BringWindowToTop SetFocus

wtsapi32

WTSSendMessageW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wintrust

WinVerifyTrust

gdi32

CreateDIBSection SelectObject StretchBlt SetStretchBltMode DeleteDC DeleteObject CreateCompatibleDC

iphlpapi

NotifyIpInterfaceChange

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

secur32

AcquireCredentialsHandleA InitializeSecurityContextW AcceptSecurityContext FreeContextBuffer EncryptMessage DecryptMessage FreeCredentialsHandle ApplyControlToken QueryContextAttributesW DeleteSecurityContext

ws2_32

WSASocketW WSASend send recv freeaddrinfo getaddrinfo WSACleanup WSAStartup WSAIoctl shutdown bind getsockname getpeername setsockopt WSAGetLastError getsockopt connect ioctlsocket closesocket

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

ntdll

NtDeviceIoControlFile NtCreateNamedPipeFile NtOpenFile NtReadFile RtlNtStatusToDosError NtCancelIoFileEx NtWriteFile NtCreateFile

Name

.text

Size

5.0MB

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

212KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

file_ea7a051a82d4b3b5.exe

crypt32

kernel32

user32

wtsapi32

version

wintrust

gdi32

iphlpapi

bcryptprimitives

api-ms-win-core-synch-l1-2-0

secur32

ws2_32

bcrypt

advapi32

ntdll

generic