meshagent | fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373.exe
Size 1.6MB
Sample240825-pdvgystdlc
SHA256 fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373
MD5 dc37d19933e5689c25bc6cce8c15d58c
SHA1 5465ed40e9ce77663bcb5213cf7deb6bded25804
SHA512 15ca53e95a2e74d17b87778354ed7508192fb2225ca6c40db7693909c35b02726472f19b060be878c02f5d89c17f99ffaf7600289f82930fdfd28507fa1b881d
SSDEEP 24576:zadIJEV+Vz4OjRZMpM2wSZB8Q04KfA3NapQpN65NlwBy8rTx3ZmIkmu3ylHAhf8:WIii8uqMIBv09cNgHwBy8rVkUkyR+U
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

meshagent

Malware Config

Signatures

Detects MeshAgent payload 1 IoCs

resource	yara_rule
static1/unpack001/leonardo-mesh.exe	family_meshagent

Meshagent family
meshagent

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373.exe
unpack001/leonardo-mesh.exe

File Explorer

fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373.exe

.exe 1.6MB
leonardo-mesh.exe

.exe 3.7MB

fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373.exe

IMPHASH 9dda1a1d1f8a1d13ae0297b47046b26e
SHA256 fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373
MD5 dc37d19933e5689c25bc6cce8c15d58c
SHA1 5465ed40e9ce77663bcb5213cf7deb6bded25804
SHA512 15ca53e95a2e74d17b87778354ed7508192fb2225ca6c40db7693909c35b02726472f19b060be878c02f5d89c17f99ffaf7600289f82930fdfd28507fa1b881d
SSDEEP 24576:zadIJEV+Vz4OjRZMpM2wSZB8Q04KfA3NapQpN65NlwBy8rTx3ZmIkmu3ylHAhf8:WIii8uqMIBv09cNgHwBy8rVkUkyR+U
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13925

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

leonardo-mesh.exe

IMPHASH 7aa58492bf5691114c98568704d048cd
SHA256 7c4ac45d254e50dac72902c8f0cd2b5eb474818c15a01887e6b8ed5ed71cac8d
MD5 e15811177975fb1c9e916807aa6a9f3a
SHA1 5c64afef7bb8770f897b424dc91352ae472bb637
SHA512 3aebb5ef4cafaf2dfffebbfad427aa48be6148222b5896f4f7f575720b09e24af4c05936aa37342d26b6f7d6c0b502a44697944274b725facd1dd8a212142f92
SSDEEP 49152:v8o8bZjyJVD0s9Mr3XIfRviWkgEOaxfCbCMcXGtSgvZPOQ5Qj:v8o8VOUs9joRbMc2tSW6j
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Detects MeshAgent payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1840496

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\MeshAgent\MeshAgent\Release\MeshService.pdb

comctl32

InitCommonControlsEx

crypt32

CryptEncodeObject CertDuplicateCertificateContext CertEnumCertificatesInStore CertDeleteCertificateFromStore CryptAcquireCertificatePrivateKey CertAddEncodedCertificateToStore CryptMsgClose CryptMsgUpdate CryptExportPublicKeyInfo CertCreateSelfSignCertificate CertFreeCertificateContext CryptMsgOpenToEncode CertAddCertificateContextToStore CryptMsgOpenToDecode CryptMsgControl CertStrToNameW CertOpenStore CryptMsgCalculateEncodedLength CertFindCertificateInStore CertSetCertificateContextProperty CertGetCertificateContextProperty CryptMsgGetParam CertStrToNameA CertCloseStore CryptSignAndEncodeCertificate PFXExportCertStore

ncrypt

NCryptCreatePersistedKey BCryptGetProperty BCryptOpenAlgorithmProvider NCryptOpenStorageProvider BCryptCreateHash NCryptSetProperty BCryptHashData NCryptFreeObject NCryptFinalizeKey BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGenRandom

dbghelp

SymInitialize SymFromAddr MiniDumpWriteDump SymGetModuleBase64 SymGetLineFromAddr64 SymFunctionTableAccess64 StackWalk64

iphlpapi

GetAdaptersAddresses SendARP ConvertLengthToIpv4Mask GetAdaptersInfo

ws2_32

__WSAFDIsSet htons htonl gethostname ntohs ntohl WSAGetLastError ioctlsocket recv send gethostbyname getaddrinfo freeaddrinfo getnameinfo WSASetLastError getsockname WSASocketW listen closesocket bind accept WSACleanup FreeAddrInfoW select WSACloseEvent WSACreateEvent WSAStartup WSAEventSelect WSAResetEvent GetAddrInfoW WSAIoctl shutdown connect recvfrom getsockopt sendto socket setsockopt

gdiplus

GdipCloneImage GdipAlloc GdiplusStartup GdiplusShutdown GdipDisposeImage GdipLoadImageFromStreamICM GdipFree GdipGetImageEncodersSize GdipSaveImageToStream GdipLoadImageFromStream GdipGetImageEncoders

kernel32

InterlockedPushEntrySList InterlockedFlushSList RtlUnwind EnterCriticalSection GetFullPathNameW GetStdHandle WriteFile LoadLibraryExA GetModuleFileNameW GetSystemPowerStatus OpenProcess MultiByteToWideChar Sleep GetLastError CloseHandle GetCurrentDirectoryW SetCurrentDirectoryW GetProcAddress SetEnvironmentVariableA CreateProcessW FreeLibrary WideCharToMultiByte GetCurrentThreadId GetModuleHandleA WaitForSingleObjectEx CreateThread QueueUserAPC OpenThread ReadFile LoadLibraryA SleepEx SetSystemPowerState GetCurrentProcess SetThreadExecutionState HeapFree HeapAlloc GetProcessHeap SystemTimeToFileTime GetSystemTime FileTimeToSystemTime LeaveCriticalSection SystemTimeToTzSpecificLocalTime QueryPerformanceCounter ReleaseSemaphore WaitForSingleObject CreateSemaphoreA CancelIo FindFirstFileW FindNextFileW RemoveDirectoryW GetFinalPathNameByHandleW GetDriveTypeA SetFilePointer FindFirstVolumeA FindClose CreateFileW GetVolumePathNamesForVolumeNameA GetFileAttributesExW ReadDirectoryChangesW FindNextVolumeA FindVolumeClose GetDiskFreeSpaceExA CreateEventA GetModuleHandleExA WaitForMultipleObjectsEx CreateNamedPipeA DisconnectNamedPipe CreateFileA CancelIoEx LocalFree ConnectNamedPipe SetConsoleMode GetConsoleMode GetStartupInfoW IsDebuggerPresent TerminateProcess GetTempPathW CancelSynchronousIo SetEvent ResetEvent GetThreadId GetCurrentProcessId GetEnvironmentStrings FreeEnvironmentStringsA CopyFileW MoveFileW RtlCaptureContext SuspendThread ResumeThread DuplicateHandle ExitThread GetTickCount64 GetCurrentThread DeleteFileA GetOverlappedResult GetThreadContext WTSGetActiveConsoleSessionId GetExitCodeProcess SetEndOfFile DeleteFileW SetFilePointerEx SetConsoleCtrlHandler FreeConsole LoadLibraryExW SetLastError GetFileType GetModuleHandleW FormatMessageW SwitchToFiber DeleteFiber CreateFiber GetSystemTimeAsFileTime ConvertFiberToThread ConvertThreadToFiber GetEnvironmentVariableW ReadConsoleA ReadConsoleW DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW CreateProcessA HeapValidate GetSystemInfo CreateDirectoryW GetConsoleCP MoveFileExW SetEnvironmentVariableW SetCurrentDirectoryA GetCurrentDirectoryA GetTimeZoneInformation SetStdHandle GetDriveTypeW PeekNamedPipe GetModuleFileNameA GetCommandLineA GetCommandLineW GetACP RaiseException GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter SetConsoleOutputCP IsProcessorFeaturePresent GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers HeapReAlloc HeapSize HeapQueryInformation GetStringTypeW WriteConsoleW GetCPInfo GetFullPathNameA OutputDebugStringA OutputDebugStringW FindFirstFileExA FindFirstFileExW FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW EncodePointer QueryPerformanceFrequency DecodePointer

user32

EndDialog SetWindowTextW GetWindowPlacement ShowWindow GetDlgCtrlID SetWindowPlacement SetWindowTextA IsDlgButtonChecked GetDlgItem CheckDlgButton DialogBoxParamW EnableWindow MessageBeep ExitWindowsEx GetUserObjectInformationA EnumDisplayMonitors GetSystemMetrics SetThreadDesktop GetThreadDesktop CloseDesktop BlockInput GetMonitorInfoA OpenInputDesktop GetKeyState GetMessageA GetWindowRect SendMessageW LoadCursorA DestroyWindow GetDC PostMessageA GetIconInfo CallNextHookEx GetCursorInfo SetWindowsHookExA MapVirtualKeyA GetForegroundWindow UnhookWindowsHookEx DefWindowProcA CreateWindowExA TranslateMessage UnregisterClassA DrawIconEx SetWinEventHook RegisterClassExA UnhookWinEvent SetForegroundWindow ReleaseDC SendInput SetProcessDPIAware GetProcessWindowStation GetUserObjectInformationW DispatchMessageA CreateWindowExW MessageBoxW GetMessageExtraInfo

gdi32

DeleteObject GetDIBits CreateCompatibleDC SelectObject CreateCompatibleBitmap SetStretchBltMode DeleteDC StretchBlt BitBlt GetObjectA CreateSolidBrush SetBkColor SetBkMode SetTextColor GetStockObject

advapi32

RegOpenKeyExA RegCloseKey CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource StartServiceCtrlDispatcherA QueryServiceStatus CloseServiceHandle AllocateAndInitializeSid SetServiceStatus OpenSCManagerA RegisterServiceCtrlHandlerExA FreeSid CheckTokenMembership OpenServiceA SetTokenInformation CreateProcessAsUserW DuplicateTokenEx SetSecurityDescriptorDacl SetEntriesInAclA InitializeSecurityDescriptor CryptDestroyKey RegQueryValueExA RegSetValueExW RegOpenKeyExW RegQueryValueExW CryptReleaseContext AdjustTokenPrivileges LookupPrivilegeValueA InitiateSystemShutdownA RegCreateKeyW RegSetValueExA RegDeleteKeyA OpenProcessToken

shell32

ShellExecuteExW

ole32

CoCreateInstance CreateStreamOnHGlobal CoInitializeEx CoUninitialize

oleaut32

SysAllocString SysFreeString SysStringLen

fabfaa8fe68a80b286ea7291977e73a830320db89c9acdbfc3373884246f6373.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

leonardo-mesh.exe

comctl32

crypt32

ncrypt

dbghelp

iphlpapi

ws2_32

gdiplus

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

generic