Trojan.ShellcodeRunner.BG
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 19,730 |
| Threat Level: | 80 % (High) |
| Infected Computers: | 44 |
| First Seen: | December 16, 2024 |
| Last Seen: | July 5, 2026 |
| OS(es) Affected: | Windows |
The detection of Trojan.ShellcodeRunner.BG on your system indicates a potential security threat that requires immediate attention. This detection name suggests a type of malware that could be used to execute arbitrary code on the infected machine, potentially leading to a variety of malicious activities. Understanding the nature of this threat and taking appropriate steps to remove it is crucial to protecting your personal data and the integrity of your computer system.
Table of Contents
What Is Trojan.ShellcodeRunner.BG?
Trojan.ShellcodeRunner.BG is identified as a Trojan-type threat. Trojans are malicious programs that disguise themselves as legitimate software but actually allow unauthorized access to a computer. The term "ShellcodeRunner" implies that this malware might be designed to execute shellcode, which is a small piece of code used as the payload in an exploit. Shellcode is typically used to exploit vulnerabilities in software to gain control over a system. The ".BG" suffix might indicate a specific variant or a tag used by the malware authors, but without more context, its exact significance is unclear.
How Trojan.ShellcodeRunner.BG Operates
Trojan.ShellcodeRunner.BG, like other Trojans, operates by deceiving users into installing it on their systems. This can happen through various means, such as opening malicious email attachments, downloading software from untrusted sources, or visiting compromised websites. Once installed, the malware can create a backdoor on the infected computer, allowing remote access and control by the attackers. This access can be used for a range of malicious activities, including data theft, installation of additional malware, or using the computer as part of a botnet for distributed denial-of-service (DDoS) attacks or spamming.
Symptoms of Infection
The symptoms of a Trojan.ShellcodeRunner.BG infection can vary widely depending on the specific goals of the malware and the actions taken by the attackers. Common signs of infection include unexpected changes to system settings, appearance of unknown programs or files, slower system performance, and unusual network activity. Some infections may not display obvious symptoms, making them harder to detect without the use of security software.
How to Remove Trojan.ShellcodeRunner.BG
- Enter Safe Mode with Networking to limit the malware's ability to interfere with the removal process. This mode loads only the necessary drivers and services, making it easier to remove malicious programs.
- Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter. Ensure the software is updated with the latest definitions to improve the chances of detecting and removing the malware.
- Uninstall suspicious programs that you do not recognize or that were installed around the time the malware was detected. Be cautious and only uninstall programs you are sure are malicious or unnecessary.
- Reset your web browsers (Chrome, Firefox, Edge) to their default settings to remove any malicious extensions or settings changes made by the malware.
- After completing the above steps, reboot your computer and perform another full scan with your anti-malware software to ensure that all components of the malware have been removed.
Conclusion
Removing Trojan.ShellcodeRunner.BG requires careful and immediate action to prevent further damage to your system and protect your personal data. By following the steps outlined above and maintaining good security practices, such as regularly updating your operating system and software, using strong, unique passwords, and being cautious with emails and downloads, you can significantly reduce the risk of future infections. Remember, prevention and vigilance are key components of cybersecurity, and staying informed about the latest threats and how to protect against them is essential in today's digital landscape.
Analysis Report
General information
| Family Name: | Trojan.ShellcodeRunner.BG |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
54169b9bf60468c823068d42d12eb70d
SHA1:
9eced313bc6c3cd6c10c4d6d219342a48e299538
SHA256:
2C2ECA6181FFC5002BF9F0EA3E7ACA000D578F6484E40A349AF66B175DA57639
File Size:
1.62 MB, 1622016 bytes
|
|
MD5:
65b77a26121e757a7c5037418794ebfa
SHA1:
9e90b3c6658d1bcf5237d4f96b6db46aff948428
SHA256:
446C7FAFB49251C34A38778E669821572BA7ED448FCAC4838A95922C2BB04A90
File Size:
1.66 MB, 1664512 bytes
|
|
MD5:
0612ad30050a6bf111234d9f4015aa4f
SHA1:
aae2523e2c60676bd2f9952add7082a597fa1804
SHA256:
6C0D1487841C409DF25E655E2FC7397EDD5000196FC94CD178885B547AA20200
File Size:
3.74 MB, 3743744 bytes
|
|
MD5:
af15ff18698783dc96a98e52978b3859
SHA1:
54d4fd7f25caddfbbdc5340a9ce2eb61954b45a5
SHA256:
1D681462A4F7BBB080A3DCE0C27B04D4D7EEFBAF03B908A8A22FD1FFBA5FD246
File Size:
5.14 MB, 5135872 bytes
|
|
MD5:
ae94d9d75396c10121be36ddf0f903ff
SHA1:
701b75f2f23aeb21d316dc17270b88f6dbe9c1de
SHA256:
5BCF1F55CFB968EE123B947063A20BF24FF0AD052FA3E90D789495FDB58DDBB4
File Size:
2.69 MB, 2693120 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have resources
- File doesn't have security information
- File has TLS information
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Company Name | StormGate Labs |
| File Description | Swarm-style patch management for volatile environments. |
| File Version | 2.8.2 |
| Internal Name | PatchVortex |
| Legal Copyright | Copyright (C) 2025 StormGate Labs |
| Original Filename | PatchVortex.exe |
| Product Name | PatchVortex |
| Product Version | 2.8.2 |
File Traits
- 2+ executable sections
- CryptUnprotectData
- HighEntropy
- No CryptProtectData
- No Version Info
- ntdll
- Pastebin
- VirtualQueryEx
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 5,960 |
|---|---|
| Potentially Malicious Blocks: | 710 |
| Whitelisted Blocks: | 5,249 |
| Unknown Blocks: | 1 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.COV
- PSW.Agent.CR
- ShellcodeRunner.BG
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe\__rust_anonymous_pipe1__.8844.16402797683740608741 | Generic Write,Read Attributes |
| \device\namedpipe\__rust_anonymous_pipe1__.8844.16402797683740608742 | Generic Write,Read Attributes |
| \device\namedpipe\__rust_anonymous_pipe1__.8844.16402797683740608743 | Generic Write,Read Attributes |
| \device\namedpipe\__rust_anonymous_pipe1__.8844.16402797683740608744 | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\prysmax\screenshot_20260125_144658.bmp | Generic Write,Read Attributes |
| c:\users\user\downloads\obs.db | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 첌胔蹌ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 舝蹌ǜ | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
7 additional items are not displayed above. |
| Keyboard Access |
|
| User Data Access |
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Anti Debug |
|
| Other Suspicious |
|
| Process Terminate |
|
| Cert Store Read |
|
| Network Winsock2 |
|
| Network Winsock |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\WINDOWS\system32\tasklist.exe "tasklist"
|
