Extracted

• • Target
    Loader.exe
  • Size 5.3MB
  • SHA256 acb4fdd8eab403dd309015ff8d73334ce7fb1656a627ae837804e59a1b20005a
  • MD5 52922ceeab0a95443710310269e0bd6b
  • SHA1 ae3623103310c8bc62efcb8538800efeffee931f
  • SHA512 ccc9a72d8642e167dce9f1ed0078e48cde9dd762499de5b15cc64bba86935ffa3e21d18c5cfc629ce25fe8e8444ea58a0ee71fb31a3bfe4e20d0d468a23edf41
  • SSDEEP 49152:xs+66Hc/D0wh/wi94JQcnq0HNIg7krE5nYwe4U4ae/b9HWcXotBi7Nwe:O+cX9wi9bVEkKDTLB2hqNV
  • TLSH
    T11E46AE4D387AF3BAD088DB7F98A45640766000FD188B5FF31E95D6CE6E4B34A6A76043
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionbridgeagentloaderpersistenceprivilege_escalationspywarestealer

  • Detects BridgeAgent aka ShadowHVNC loader

  • Family: BridgeAgent,ShadowHVNC

    BridgeAgent aka ShadowHVNC is a Windows backdoor and loader written in Rust.

    backdoorloaderbridgeagent

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Reads ssh keys stored on the system

    Tries to access SSH used by SSH programs.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  behavioral1behavioral2