meshagent | e31a69254f2a8e82498b46242d073858373dbb0f8f8281ddb107d06de3038f49[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
e31a69254f2a8e82498b46242d073858373dbb0f8f8281ddb107d06de3038f49.exe
Size 5.9MB
Sample240906-x7ebtsvaqe
SHA256 e31a69254f2a8e82498b46242d073858373dbb0f8f8281ddb107d06de3038f49
MD5 e3ff81d31d57ace21b0cc50a5eff97e1
SHA1 8b7256541dc2344d07fa38208ee88f59edca2bd3
SHA512 eff78f35b24982dcc4f968e62093eaae9cecce35b9b3ce98512d55880f0aa5b5a3142d4358a2dfa5cf875a5db614b5b9d7046db08b8ef5602416d2c22ad1d2f5
SSDEEP 49152:cGqicgQaP92S7kuPE7QZXWHT2aAholvg31QZ7p3NI3l5bK8JJ:7Qy9z7kusEx3RVka
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

meshagent

Malware Config

Signatures

Detects MeshAgent payload 1 IoCs

resource	yara_rule
sample	family_meshagent

Meshagent family
meshagent

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e31a69254f2a8e82498b46242d073858373dbb0f8f8281ddb107d06de3038f49.exe

File Explorer

e31a69254f2a8e82498b46242d073858373dbb0f8f8281ddb107d06de3038f49.exe

.exe 5.9MB

e31a69254f2a8e82498b46242d073858373dbb0f8f8281ddb107d06de3038f49.exe

IMPHASH 5c0d041bec4d36c68c76a99955a498a2
SHA256 e31a69254f2a8e82498b46242d073858373dbb0f8f8281ddb107d06de3038f49
MD5 e3ff81d31d57ace21b0cc50a5eff97e1
SHA1 8b7256541dc2344d07fa38208ee88f59edca2bd3
SHA512 eff78f35b24982dcc4f968e62093eaae9cecce35b9b3ce98512d55880f0aa5b5a3142d4358a2dfa5cf875a5db614b5b9d7046db08b8ef5602416d2c22ad1d2f5
SSDEEP 49152:cGqicgQaP92S7kuPE7QZXWHT2aAholvg31QZ7p3NI3l5bK8JJ:7Qy9z7kusEx3RVka
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detects MeshAgent payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3658288

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\yfjvy\Downloads\MeshAgent-master\Debug\MeshService64.pdb

comctl32

InitCommonControlsEx

dbghelp

MiniDumpWriteDump SymInitialize SymGetLineFromAddr64 SymGetModuleBase64 SymFunctionTableAccess64 StackWalk64 SymFromAddr

iphlpapi

ConvertLengthToIpv4Mask SendARP GetAdaptersInfo GetAdaptersAddresses

ws2_32

WSAResetEvent htonl htons ntohl ntohs gethostname __WSAFDIsSet WSASetLastError accept bind closesocket ioctlsocket getsockname listen recv send WSAGetLastError WSASocketW setsockopt socket connect getsockopt recvfrom sendto shutdown WSAIoctl select WSAStartup WSACleanup WSACloseEvent WSACreateEvent WSAEventSelect FreeAddrInfoW GetAddrInfoW

crypt32

CertDuplicateCertificateContext CertEnumCertificatesInStore CryptEncodeObject CryptMsgOpenToEncode CryptMsgCalculateEncodedLength CryptMsgOpenToDecode CryptMsgClose CryptMsgUpdate CryptMsgGetParam CryptMsgControl CertOpenStore CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertSetCertificateContextProperty CertAddEncodedCertificateToStore CertAddCertificateContextToStore CertDeleteCertificateFromStore CryptSignAndEncodeCertificate CryptExportPublicKeyInfo CertGetCertificateContextProperty CertStrToNameA CertStrToNameW CertCreateSelfSignCertificate PFXExportCertStore CryptAcquireCertificatePrivateKey

gdiplus

GdipGetImageEncodersSize GdipGetImageEncoders GdipSaveImageToStream GdipDisposeImage GdipFree GdiplusStartup GdiplusShutdown GdipLoadImageFromStream GdipCloneImage GdipLoadImageFromStreamICM GdipAlloc

ncrypt

NCryptOpenStorageProvider NCryptCreatePersistedKey NCryptSetProperty NCryptFinalizeKey BCryptFinishHash NCryptFreeObject BCryptCreateHash BCryptCloseAlgorithmProvider BCryptGetProperty BCryptOpenAlgorithmProvider BCryptDestroyHash BCryptGenRandom BCryptHashData

kernel32

VirtualQuery InitializeSListHead GetStartupInfoW RtlUnwindEx GetStdHandle SetEnvironmentVariableA SetCurrentDirectoryW GetCurrentDirectoryW GetFullPathNameW WriteFile CloseHandle GetLastError Sleep CreateProcessW OpenProcess FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryExA GetSystemPowerStatus MultiByteToWideChar WideCharToMultiByte WaitForSingleObjectEx QueueUserAPC CreateThread GetCurrentThreadId OpenThread GetModuleHandleA ReadFile SleepEx LoadLibraryA GetCurrentProcess SetThreadExecutionState SetSystemPowerState HeapAlloc HeapFree GetProcessHeap GetSystemTime SystemTimeToFileTime QueryPerformanceCounter QueryPerformanceFrequency FileTimeToSystemTime ReleaseSemaphore WaitForSingleObject CreateSemaphoreA CreateFileW FindClose FindFirstFileW FindNextFileW FindVolumeClose GetDiskFreeSpaceExA GetDriveTypeA GetFileAttributesExW GetFinalPathNameByHandleW RemoveDirectoryW SetFilePointer CancelIo CreateEventA ReadDirectoryChangesW FindFirstVolumeA FindNextVolumeA GetVolumePathNamesForVolumeNameA GetModuleHandleExA WaitForMultipleObjectsEx CreateFileA ConnectNamedPipe DisconnectNamedPipe CancelIoEx LocalFree CreateNamedPipeA IsDebuggerPresent GetConsoleMode SetConsoleMode SetConsoleOutputCP GetEnvironmentStrings FreeEnvironmentStringsA GetTempPathW CancelSynchronousIo SetEvent ResetEvent RtlLookupFunctionEntry TerminateProcess GetThreadId CopyFileW MoveFileW RtlCaptureContext DeleteFileA DuplicateHandle GetOverlappedResult GetCurrentThread ExitThread SuspendThread ResumeThread GetThreadContext GetTickCount64 GetExitCodeProcess WTSGetActiveConsoleSessionId DeleteFileW SetEndOfFile SetFilePointerEx OutputDebugStringA LoadLibraryExW FreeConsole SetConsoleCtrlHandler SetLastError GetFileType OutputDebugStringW GetModuleHandleW SwitchToFiber DeleteFiber CreateFiber GetSystemTimeAsFileTime ConvertFiberToThread ConvertThreadToFiber GetEnvironmentVariableW ReadConsoleA ReadConsoleW EncodePointer RtlUnwind EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree RtlPcToFileHeader ExitProcess GetModuleHandleExW HeapSize HeapValidate GetSystemInfo CreateDirectoryW MoveFileExW GetConsoleOutputCP SetEnvironmentVariableW WriteConsoleW GetTimeZoneInformation SetStdHandle GetDriveTypeW GetFileInformationByHandle PeekNamedPipe GetCommandLineA GetCommandLineW FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW FlushFileBuffers GetFileSizeEx RtlVirtualUnwind HeapReAlloc RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcessId IsProcessorFeaturePresent HeapQueryInformation GetCPInfo FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SystemTimeToTzSpecificLocalTime GetStringTypeW

user32

GetDlgCtrlID IsDlgButtonChecked CheckDlgButton GetDlgItem EndDialog DialogBoxParamW SetWindowPlacement GetWindowPlacement ShowWindow CreateWindowExW SendMessageW MessageBeep ExitWindowsEx BlockInput EnumDisplayMonitors GetMonitorInfoA GetSystemMetrics GetUserObjectInformationA GetThreadDesktop CloseDesktop SetThreadDesktop OpenInputDesktop GetCursorInfo UnhookWinEvent GetWindowRect EnableWindow DrawIconEx LoadCursorA CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA ReleaseDC GetDC SetForegroundWindow GetForegroundWindow MapVirtualKeyA SendInput GetKeyState DestroyWindow CreateWindowExA RegisterClassExA UnregisterClassA DefWindowProcA PostMessageA GetMessageExtraInfo DispatchMessageA TranslateMessage GetMessageA SetProcessDPIAware GetProcessWindowStation MessageBoxW SetWindowTextA GetIconInfo SetWindowTextW GetUserObjectInformationW SetWinEventHook

gdi32

CreateSolidBrush SetStretchBltMode StretchBlt DeleteDC BitBlt GetObjectA SelectObject GetDIBits DeleteObject CreateCompatibleBitmap CreateCompatibleDC GetStockObject SetBkColor SetBkMode SetTextColor

advapi32

RegisterServiceCtrlHandlerExA QueryServiceStatus CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource StartServiceCtrlDispatcherA RegCloseKey RegCreateKeyW RegDeleteKeyA RegSetValueExA RegOpenKeyExA OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA InitiateSystemShutdownA RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExW CryptReleaseContext CryptDestroyKey InitializeSecurityDescriptor SetSecurityDescriptorDacl SetEntriesInAclA CreateProcessAsUserW DuplicateTokenEx SetTokenInformation AllocateAndInitializeSid CheckTokenMembership FreeSid CloseServiceHandle OpenSCManagerA OpenServiceA SetServiceStatus

shell32

ShellExecuteExW

ole32

CoCreateInstance CreateStreamOnHGlobal CoUninitialize CoInitializeEx

oleaut32

SysStringLen SysFreeString SysAllocString