Extracted

• • Target
    file.exe
  • Size 12.0MB
  • SHA256 d39be9b1c8bdca49b3d814849ae507df280c6fe967e5c08fadfdc81d6f2f1cbc
  • MD5 06d5333f7d48aede561155bc021ebadd
  • SHA1 b64bc5e7c9b85a2415866a9ad058dbeef93df01d
  • SHA512 7a013196c12befea39c0f75f130f1540c390b64671ee550990e6737c4886d75389593f8631648a63f4cee195490d293613f8d6b04d4667c1682b8ef1373878bd
  • SSDEEP 6144:Y0D2u8nLpFNNvvDqz3blJYZYE1jm1euRQzJpGKAx0:uu+K30ZYAmvKF
  • TLSH
    T110C69D19FBA914F9E177C17CC9530905EA72BC460761ABCF23A05AA61F236E09E3F711
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionbridgeagentloaderpersistenceprivilege_escalationspywarestealer

  • Detects BridgeAgent aka ShadowHVNC loader

  • Family: BridgeAgent,ShadowHVNC

    BridgeAgent aka ShadowHVNC is a Windows backdoor and loader written in Rust.

    backdoorloaderbridgeagent

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Reads ssh keys stored on the system

    Tries to access SSH used by SSH programs.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  behavioral1behavioral2