TL;DR
- ShadowAgent (Windows RAT): A RAT masquerading as a PDF document, targeting government systems. The primary goal is to send confidential information to attackers using WebSockets and HTTP for continuous command and control exchange. It can be detected by abnormal mutex creation.
- UDPGangster (Windows backdoor): A UDP-oriented backdoor associated with the MuddyWater group. After executing a macro in a document, the trojan is installed in the user profile. It supports remote command execution, file uploads, and exfiltration via UDP channels, complicating network detection.
1) ShadowAgent (Windows)
Sample: ANY.RUN
ShadowAgent is a RAT masquerading as a PDF document and targeting government systems. Its primary goal is to send confidential information to attackers using WebSockets and HTTP for continuous command and control exchange.
How to detect: Detection is possible by monitoring abnormal mutex creation.
Key facts:
- The malware starts its activity by reading encrypted configuration data and establishing persistence via a scheduled task.
- Provides remote control capabilities.
- Primarily targets government infrastructure.
Analytical note:
| Detected | External sources | ANY.RUN First Submission | Sandbox Evasion | VT First Submission |
|---|---|---|---|---|
| 2025-12-01 | TI | 2025-12-10 | 3 | 2025-11-03 |
With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.
TI Lookup:
syncObjectName:"asus_*_v"
IOCs:
- SHA256:
9680a1f6d24c499becf5d497abbc0ba7d140a4ad6c814336b45d9ee4189a07c0 - SHA256:
58d4429ac78b74b64843fe4fbdfd3f4a41ee1139a0b2c7a41dc8e10f0d207780 - Domain:
www[.]mydropboxbackup[.]com
MITRE:
| Technique ID | Technique Name | Evidence |
|---|---|---|
| T1053 | Scheduled Task/Job | Creates scheduled task for persistence |
| T1480.002 | Execution Guardrails: Mutual Exclusion | Actions based on the presence of a mutex associated with malware |
| T1497.003 | Virtualization/Sandbox Evasion: Time Based Checks | Uses Task Scheduler to run other applications |
| T1012 | Query Registry | Reads security settings of browsers and different system settings via registry |
| T1082 | System Information Discovery | Reads different system information |
2) UDPGangster (Windows)
Sample: ANY.RUN
UDPGangster is a UDP-oriented backdoor associated with the MuddyWater group. After executing a macro in a document, the trojan is installed in the user profile. It supports remote command execution, file uploads, and exfiltration via UDP channels, complicating network detection.
How to detect: Detection is possible by monitoring registry writes to HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell for startup persistence and the mutex named xhxhxhxhxhxpp.
Key facts:
- Uses UDP channels for C2 and exfiltration, making it difficult to detect on traditional HTTP/HTTPS filters.
- Extensive anti-analysis techniques, including checks for virtual environments and sandboxes, aimed at evading automated analyzers.
- Linked to MuddyWater, operational campaigns in Turkey and Israel aimed at cyber espionage and targeted data collection.
Analytical note:
| Detected | External sources | ANY.RUN First Submission | Sandbox Evasion | VT First Submission |
|---|---|---|---|---|
| 2025-11-25 | News | 2025-11-25 | 7 | 2025-10-11 |
With the following TI Lookup query, we can search through recent public sandbox analyses and identify this malicious activity.
TI Lookup:
syncObjectName:"xhxhxhxhxhxpp"
TI Lookup:
commandLine:"cmd.exe /c start*msedge.exe*.pdf" or registryValue:"AppData\\RoamingLow"
IOCs:
- SHA256:
930f0dc9929c6097f718b42d1dbad42d0263ffac5d598a81fc6fa1ea1f58c41c - Mutex:
xhxhxhxhxhxpp - C2 IP:
64.7.198.12
MITRE:
| Technique ID | Technique Name | Evidence |
|---|---|---|
| T1566.001 | Phishing: Attachment | Used PDF lure for payload delivery. |
| T1204.002 | User Execution: Malicious File | Backdoor launch occurs after manual PDF opening. |
| T1547.001 | Registry Run Keys | Persistence through HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell. |
| T1059.003 | Windows Command Execution | Execution of operator's control commands through shell. |
| T1071.001 | Web Protocol: HTTP | C2 traffic and command retrieval via HTTP. |
Conclusion
1) RATs continue to masquerade as documents: Both samples demonstrate the use of PDF for infiltrating government systems with a focus on data exfiltration.
2) Backdoors are using UDP: UDPGangster from MuddyWater uses UDP for C2; recently, various methods of C2 communication have been encountered, so it's necessary to ensure that at least the main protocols for communication are covered.