Extracted

• • Target

    meshagent64-Agents.exe

  • Size

    3.3MB

  • MD5

    5f2673342f7b252551dd063118bad41f

  • SHA1

    c64c1f88c9f1a526c6d09d62a253252c139fa644

  • SHA256

    b38f5abfa480b45c46d3eed7e8a6b4859888921358e57bd7649a70c4a3be5f90

  • SHA512

    35ce5b6d8a3376452d2ec4409e2b3f79e7f4a0b28d04cccb1f2a5cf2391d7b791909e0ddff0c8290e0889908973384408ed1f2a21605f65a6d89a061bafe6a67

  • SSDEEP

    49152:/X3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Q7:/lRsZ47/QXoHUOfAoj1x67

  Score

  10^/10

  meshagentagentsbackdoordiscoverypersistencerattrojan

  • Detects MeshAgent payload

  • MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

    rattrojanbackdoormeshagent

  • Sets service image path in registry

    persistence

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2