Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

meshagent6...ts.exe

windows7-x64

10

meshagent6...ts.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    meshagent64-Agents.exe

  • Size

    3.3MB

  • MD5

    5f2673342f7b252551dd063118bad41f

  • SHA1

    c64c1f88c9f1a526c6d09d62a253252c139fa644

  • SHA256

    b38f5abfa480b45c46d3eed7e8a6b4859888921358e57bd7649a70c4a3be5f90

  • SHA512

    35ce5b6d8a3376452d2ec4409e2b3f79e7f4a0b28d04cccb1f2a5cf2391d7b791909e0ddff0c8290e0889908973384408ed1f2a21605f65a6d89a061bafe6a67

  • SSDEEP

    49152:/X3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Q7:/lRsZ47/QXoHUOfAoj1x67

Score
10/10
agentsmeshagent

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

Agents

C2

http://192.168.120.103:443/agent.ashx

Attributes
  • mesh_id

    0xBB1227C2C5DBF5D22F9A9FAD3E22FA627FA00027B1498C77028683DDE4F7C266D262698C3E2580C2E6717E6DA0EDDDFE

  • server_id

    0ECE9AA53A3AFECFCE435ABEE5D9E9F8224B00636C0CCC9F39E61F4BB30B1023F087634BEFB9D852CD99E86B5BA50B8E

  • wss

    wss://192.168.120.103:443/agent.ashx

Signatures

  • Detects MeshAgent payload 1 IoCs
  • Meshagent family
    meshagent
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • meshagent64-Agents.exe
    .exe windows:6 windows x64 arch:x64

    Password: infected

    fb0a8b4a81655f744a37af985e009476


    Headers

    Imports

    Sections