meshagent

Resubmissions

27/08/2024, 01:28

240827-bvntvaxfpp10

27/08/2024, 01:00

240827-bc5pmswgpr10

26/08/2024, 05:53

240826-glgxtszdpp10

22/08/2024, 07:34

240822-jedb6svfpe10

Sharing

Copy URL Twitter E-mail

General

Target
26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6
Size 3.3MB
Sample240826-glgxtszdpp
SHA256 26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6
MD5 e52f30961dfc54e980d1aa1ae0d16145
SHA1 6e22251748e5cd0a9ea745a8dce14352b619ec99
SHA512 b6bbd178a529d355fc00c7ab769d3b573f778d00b05952a1700cbfd161d4c809886a9073b7de37d3210fe6f5e0823be731bb53021a8fce199d26d1f3a5e8595b
SSDEEP 49152:vX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Q9:vlRsZ47/QXoHUOfAoj1x69
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6
- Size 3.3MB
- SHA256 26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6
- MD5 e52f30961dfc54e980d1aa1ae0d16145
- SHA1 6e22251748e5cd0a9ea745a8dce14352b619ec99
- SHA512 b6bbd178a529d355fc00c7ab769d3b573f778d00b05952a1700cbfd161d4c809886a9073b7de37d3210fe6f5e0823be731bb53021a8fce199d26d1f3a5e8595b
- SSDEEP 49152:vX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Q9:vlRsZ47/QXoHUOfAoj1x69
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

meshagent backdoor discovery execution persistence trojan
- Detects MeshAgent payload
- MeshAgent
  MeshAgent is a trojan written in C++.
  trojan backdoor meshagent
- Sets service image path in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Detects MeshAgent payload

Sets service image path in registry

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2