stealer.zip
- SHA256 62bd2527f50dcbfeb6f05b179206c7dffd621b5d7057d1fa73e9712b82feec53
Password
infectedv2
Behavioral task
behavioral1
Sample
stealer.exe
Resource
win11-20260911-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target stealer.zip
- Size 2.8MB
- Sample261008-gn53fadd29
- SHA256 62bd2527f50dcbfeb6f05b179206c7dffd621b5d7057d1fa73e9712b82feec53
- MD5 efb2a0d71f47f7cd4a0c8bfe51e56f84
- SHA1 ce2958f038015f27c36ab22aa1455909071b8f09
- SHA512 0636f391167a80ad2a5cd9673531fbc93eac4518d1e01c1dcf4410975b231c8120375ba8b29ea95dd40c6b95fdeb390b0bec56db0a1a443844b6f62ca4f62579
- SSDEEP 49152:2VmVgbUCrPidzZL8uU3G3VB8VcgeWbJjQFbotaBIMOgZbVqgMdYtw7tOi42Ew7+8:4miNrMCSIZe2KFboQKMOgZbVqghthi4Q
- TLSH T11FD5332D24298F092DFC8FE76FEB1C930F997C8822426865EB6D4258F6CF22705F5516
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
bridgeagent
C2
-
93.152.223.236
Signatures
- Family: BridgeAgent,ShadowHVNC
BridgeAgent aka ShadowHVNC is a Windows backdoor and loader written in Rust.
- Detects BridgeAgent aka ShadowHVNC loader 1 IoCs
resource yara_rule static1/unpack001/stealer.exe family_bridgeagent - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/stealer.exe
File Explorer
-
stealer.zip.zip 2.8MB
-
stealer.exe.exe 7.2MB
stealer.exe
- IMPHASH 2797ccba8cc94a31426670b81b0c4915
- SHA256 92bed8b0e2db43ce70bdcc9ed2dd8ba72cdc159c025244251cea56721118abec
- MD5 00784ed9cccfc53dafe64f988e842ab5
- SHA1 85c6833680fa1e7341ddbdaef61ce53822c4dc4a
- SHA512 39ac959c41950cacfc523ecf93b0df35536216817df67ba9736ee8298440864807491010edc68bde9d19ad7f0e6955f67e5fd3ba77bf488840c1d3bce0978c30
- SSDEEP 98304:MHtDGdUzdlw9Ahji5c4LZa/AFptlYsQB7qU:I1GlR9Q9
- TLSH T111762A11BA6F55ACD55BC8B487068A239E2130DB1B3AB9FF018486393F69BF01B3D754
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects BridgeAgent aka ShadowHVNC loader
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infectedv2
Minor OS version
0
Major OS version
6
Entry point
5661548
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
IT_solutions.pdb
crypt32
CertEnumCertificatesInStore
CertDuplicateStore
CertAddCertificateContextToStore
CertGetCertificateChain
CertDuplicateCertificateContext
CryptUnprotectData
CryptProtectData
CryptStringToBinaryA
CertCreateCertificateContext
CertOpenStore
CertFreeCertificateChain
CertDuplicateCertificateChain
CertCloseStore
CertVerifyCertificateChainPolicy
CertFreeCertificateContext
kernel32
Sleep
GetCurrentProcessId
GetUserDefaultGeoName
GetLocaleInfoEx
MoveFileExW
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
SetFilePointerEx
ProcessIdToSessionId
OpenProcess
TerminateProcess
GetCurrentThreadId
HeapReAlloc
GetSystemInfo
GetProcessId
GetExitCodeProcess
GetLogicalDrives
LocalFree
GetProcessTimes
QueryFullProcessImageNameW
CreateJobObjectW
SetInformationJobObject
FlushFileBuffers
CreateMutexW
AssignProcessToJobObject
GetSystemTimePreciseAsFileTime
CreatePipe
SetHandleInformation
CreatePseudoConsole
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
ClosePseudoConsole
DeleteProcThreadAttributeList
CreateProcessW
ResumeThread
ResizePseudoConsole
WriteFile
GlobalSize
GlobalLock
GlobalUnlock
FindNextFileW
GlobalAlloc
GlobalFree
CompareStringOrdinal
GetTimeZoneInformationForYear
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
GetQueuedCompletionStatusEx
GetOverlappedResult
CreateIoCompletionPort
SetFileCompletionNotificationModes
SetLastError
GetFinalPathNameByHandleW
CancelIoEx
CreateFileW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetCurrentDirectoryW
WaitForSingleObjectEx
LoadLibraryA
GetCurrentProcess
lstrlenW
CreateMutexA
WideCharToMultiByte
ReleaseMutex
GetStdHandle
GetConsoleMode
GetConsoleOutputCP
QueryPerformanceCounter
WriteConsoleW
HeapAlloc
GetEnvironmentVariableW
WriteFileEx
SleepEx
ReadFileEx
FormatMessageW
GetModuleHandleA
GetFullPathNameW
SetWaitableTimer
SetFileInformationByHandle
FindFirstFileExW
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateDirectoryW
CreateEventW
CancelIo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetSystemDirectoryW
GetWindowsDirectoryW
GetFileAttributesW
GetModuleFileNameW
DuplicateHandle
WaitForMultipleObjects
GetCommandLineW
RemoveDirectoryW
DeleteFileW
CopyFileExW
QueryPerformanceFrequency
ReadFile
GetStringTypeW
GetFileType
SetStdHandle
SetEnvironmentVariableW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
LCMapStringW
CompareStringW
VirtualProtect
InitializeCriticalSectionEx
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetTimeZoneInformation
GetCommandLineA
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
RtlPcToFileHeader
RtlUnwindEx
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DeleteCriticalSection
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
RaiseException
PostQueuedCompletionStatus
TerminateJobObject
SwitchToThread
OutputDebugStringA
OutputDebugStringW
FormatMessageA
WaitForSingleObject
SetFileTime
CreateWaitableTimerExW
FindClose
CloseHandle
GetLastError
CreateThread
HeapFree
GetProcessHeap
MultiByteToWideChar
UnmapViewOfFile
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
GetDiskFreeSpaceA
HeapCreate
AreFileApisANSI
GetFileAttributesA
GetFileAttributesExW
FreeLibrary
GetTempPathA
CreateFileA
DeleteFileA
SystemTimeToFileTime
LoadLibraryW
HeapCompact
HeapDestroy
HeapSize
GetSystemTimeAsFileTime
GetSystemTime
CreateFileMappingW
MapViewOfFile
GetTickCount
FlushViewOfFile
UnlockFile
LockFileEx
GetDiskFreeSpaceW
GetFileSize
HeapValidate
advapi32
SystemFunction036
rstrtmgr
RmEndSession
RmGetList
RmRegisterResources
RmStartSession
user32
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
SetThreadDesktop
CloseDesktop
GetForegroundWindow
GetWindowThreadProcessId
GetClassNameW
IsWindow
IsWindowVisible
GetWindowRect
EnumDesktopWindows
GetDpiForWindow
SetThreadDpiAwarenessContext
PrintWindow
GetAncestor
SendMessageTimeoutW
AttachThreadInput
GetThreadDesktop
GetGUIThreadInfo
PostMessageW
BringWindowToTop
SetActiveWindow
SetFocus
ScreenToClient
GetClipboardSequenceNumber
GetDC
ReleaseDC
GetWindowTextLengthW
GetWindowTextW
SendInput
MapVirtualKeyW
GetKeyboardState
SetKeyboardState
OpenClipboard
RegisterSuspendResumeNotification
GetSystemMetrics
FindWindowExW
CreateDesktopW
PeekMessageW
CreateWindowExW
AddClipboardFormatListener
GetClipboardData
CloseClipboard
GetClipboardOwner
RemoveClipboardFormatListener
DestroyWindow
ChildWindowFromPointEx
OpenInputDesktop
cfgmgr32
CM_Unregister_Notification
CM_Register_Notification
ole32
CoCreateInstance
CoUninitialize
CoInitializeEx
oleaut32
SysStringLen
SysFreeString
VariantClear
wtsapi32
WTSSendMessageW
WTSRegisterSessionNotification
WTSUnRegisterSessionNotification
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
wintrust
WinVerifyTrust
gdi32
DeleteObject
SelectObject
CreateDIBSection
StretchBlt
SetStretchBltMode
DeleteDC
CreateCompatibleDC
iphlpapi
NotifyIpInterfaceChange
bcryptprimitives
ProcessPrng
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
secur32
FreeCredentialsHandle
AcquireCredentialsHandleA
ApplyControlToken
InitializeSecurityContextW
DeleteSecurityContext
FreeContextBuffer
AcceptSecurityContext
QueryContextAttributesW
DecryptMessage
EncryptMessage
ws2_32
freeaddrinfo
ioctlsocket
shutdown
connect
recv
getsockopt
closesocket
WSAGetLastError
send
WSASend
setsockopt
getpeername
getsockname
WSAIoctl
WSAStartup
WSACleanup
bind
getaddrinfo
WSASocketW
bcrypt
BCryptGenRandom
ntdll
NtReadFile
NtCreateNamedPipeFile
NtOpenFile
NtWriteFile
NtCancelIoFileEx
RtlNtStatusToDosError
NtDeviceIoControlFile
NtCreateFile
Name
.text
Size
5.5MB
Virtual Size
5.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
241KB
Virtual Size
240KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=151, id=261, version=33145,
count=19, id=260, version=33145,
count=11, id=259, version=33145,
count=10, id=259, version=35207,
count=16, id=260, version=35207,
count=41, id=261, version=35207,
count=6, id=260, version=35228,
count=27, id=257, version=33145,
count=343, id=1, productName=Unmarked objects,
count=25, productName=Unmarked objects (old),
count=1, id=258, version=35228,