Hunt BlindEagle | From Base85 Payload to Evolution RAT + HVNC Part 3
Source: YouTube · Malware Research Diary · published Aug 18, 2026 · 22:27
[BLUF]
This video analyzes a Colombian-targeted malware campaign involving a complex loader that delivers a Hidden VNC backdoor and an info-stealer via process injection, communicating with an "Evo2" C2 server via DNS. 1:11 18:10
Key Takeaways:
• The initial payload is a VBScript that decodes Base85 data to reveal a nested executable loader, which is embedded within the script or a companion binary. 0:46 1:59
• The loader utilizes a .NET framework to embed the final malicious payload within its resource section, extracting it at runtime to avoid static detection. 5:57 16:52
• Execution involves process injection, where the malware allocates memory in a target process and writes the decoded payload using functions like WriteProcessMemory and SetThreadContext. 8:04 9:17
• The core functionality is a Hidden VNC (HVNC) backdoor named "Overlord," which allows remote access while remaining undetected by standard visual inspection. 4:13 10:25
• The malware includes an info-stealer component designed to exfiltrate credentials from browsers like Google Chrome and Edge, sending this data back to the Command and Control (C2) infrastructure. 18:46 19:00
• Communication with the C2 server is facilitated through a dynamic DNS service called "Evo2DNS," utilizing DNS queries to establish a covert channel for data exfiltration. 13:11 14:08
This analysis highlights the multi-stage nature of modern malware, where obfuscation and process injection are used to deliver sophisticated remote access tools. Understanding these techniques is crucial for effective reverse engineering and detection.
Sources:
- 0:46 Introduction of the VBScript payload containing Base85 encoded data.
- 1:11 Identification of the loader component responsible for process injection.
- 1:59 Decoding the Base85 encoded payload to reveal the executable.
- 4:13 Identification of the Hidden VNC (HVNC) injection mechanism.
- 5:57 Analysis of the .NET loader and embedded resource data.
- 8:04 Explanation of the process injection technique using GetProcAddress.
- 9:17 Detailing the use of SetThreadContext to execute the injected code.
- 10:25 Identification of the "Overlord" Hidden VNC backdoor.
- 13:11 Discovery of the Evo2DNS C2 communication channel.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Malware Analysis. Commonly maps to: Security Operations, Security Architecture and Engineering. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Hello everyone, welcome back to another um session in analyzing this um Colombian target malware. So in the two video that we went through um we was um downloading the mailware from uh email to then we go walk through the process of um unpacking the um the JavaScript the payload to the final stage and the final stage that I think we add is this file. Um so the default is a VB script is containing here's the first function of decode base 85 and here's the payload that um is decryptting um they also have in the second binary for here which is I I think This is basically the loader, right? The loader. Um, and we kind have the name right here. Um, the loader with the process to halo, right? So, basically they doing process injection into um the mware. So, I think I um extract this um the last …