General

  • Target

    2024-10-13_7b97ef9a30e3bb6cb187160261d1aa8c_poet-rat_snatch

  • Size

    5.0MB

  • Sample

    241013-tgm99svdla

  • MD5

    7b97ef9a30e3bb6cb187160261d1aa8c

  • SHA1

    4a7ef7bc9040887ada6820c8d8d340ab0fe323dd

  • SHA256

    23bce4e9bb4cb146469db5a7541fcec7c6a1f668dcb2fad4e3cd92b7dd7f2a3b

  • SHA512

    14f542a6aa45e225cbaf6b7972c7c7f2ae3a3c7445e07759ea2936f97f8dee1a642eb12e6edae712c2bce68b2a7273288c237f9d174b74f8369676be3c0685bc

  • SSDEEP

    49152:pgvUDWv4e4uPpV1wrb/T8vO90d7HjmAFd4A64nsfJJKyutrDb4HGw1lfVGdJS5Bn:m4e4uPpVW6gTVegO7DfEK+ea

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

TacticalRMM

C2

http://mesh.angaragk.ru:443/agent.ashx

Attributes
  • mesh_id

    0x56A26EC09E3FA927D339904D01102E90548D375CAFC74B6A9B21011902B2FFC2569189BDF90C1790D2CF2F94A7C81CB2

  • server_id

    8B913661A7155C8CE70D79BDB7A0A320EB0AC97317E912B7A86A74D5011A68F9D4FEC39D695F8328B1B76FD67C3C40C8

  • wss

    wss://mesh.angaragk.ru:443/agent.ashx

Targets

    • Target

      2024-10-13_7b97ef9a30e3bb6cb187160261d1aa8c_poet-rat_snatch

    • Size

      5.0MB

    • MD5

      7b97ef9a30e3bb6cb187160261d1aa8c

    • SHA1

      4a7ef7bc9040887ada6820c8d8d340ab0fe323dd

    • SHA256

      23bce4e9bb4cb146469db5a7541fcec7c6a1f668dcb2fad4e3cd92b7dd7f2a3b

    • SHA512

      14f542a6aa45e225cbaf6b7972c7c7f2ae3a3c7445e07759ea2936f97f8dee1a642eb12e6edae712c2bce68b2a7273288c237f9d174b74f8369676be3c0685bc

    • SSDEEP

      49152:pgvUDWv4e4uPpV1wrb/T8vO90d7HjmAFd4A64nsfJJKyutrDb4HGw1lfVGdJS5Bn:m4e4uPpVW6gTVegO7DfEK+ea

    • Detects MeshAgent payload

    • MeshAgent

      MeshAgent is an open source remote access trojan written in C++.

    • Blocklisted process makes network request

    • Sets service image path in registry

    • Stops running service(s)

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks