One signed updater, several application-named service locations
A Bright Data-signed SDK updater is associated with service locations named for three applications, while two other updater files share at least one of those names. The overlap points to a recurring updater footprint across distinct binaries, but does not establish a common installation or confirm a sandbox’s stealer classification.
A Bright Data-signed updater is associated with Windows service locations whose names refer to three different applications: Epic Pen, Bright VPN and drvhub. Two other signed updater files share the Bright VPN service name. That recurring footprint raises a more useful question than whether a file called net_updater.exe is suspicious: what component does the record identify, and what does it show that component doing?
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read