Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• • Target

    xdr.bat

  • Size

    4KB

  • MD5

    9e779d369e3ca17fdc894d13c4fd797a

  • SHA1

    bf7e34e0da33a587177e66cfcec51f3aa75b4a87

  • SHA256

    15dd389f66e269ea795710fa580b7e403d628f281c71ebf4d845dbc7d0bdf394

  • SHA512

    ab290641c94cd7d3270a236af9f1e849ea056fddcf3120afc3dbad61afd63453eca3732093799cc6b82f2275da74d374c453a324fa9e465d931d2dff71b351b1

  • SSDEEP

    96:IQ356afgPZCo/r+ab5iGp8HRI3h8UfpTsbUdGD:Iw56afgQHRq8UfGbdD

  Score

  10^/10

  meshagenthawlatbackdoordefense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationrattrojan

  • Detects MeshAgent payload

  • MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

    rattrojanbackdoormeshagent

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Server Software Component: Terminal Services DLL

    persistence

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Sets service image path in registry

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  • Modifies WinLogon

    persistence

  • Drops file in System32 directory

  • Hide Artifacts: Hidden Users

    defense_evasion
  behavioral1behavioral2behavioral3behavioral4behavioral5