meshagent | 0c30201fa247ef384098a2360270280d73fb1cea17f4e0f9d1b829dcab620b85 | Triage

Sharing

General

Target

2024-11-07_1db373b17f59735e466cf096f4a3b2a1_frostygoop_luca-stealer_poet-rat_snatch
Size

7.1MB
Sample

241107-ysn36azrgk
MD5

1db373b17f59735e466cf096f4a3b2a1
SHA1

4dda405e028d69406cb6b870ed5a7d9e45a9a122
SHA256

0c30201fa247ef384098a2360270280d73fb1cea17f4e0f9d1b829dcab620b85
SHA512

ae391e3c8965a24dce1b1802907f59729a3ed7b93a7fdbda9f9fe00a5a6a6a43227556f87c8957a8ba2a0a8f4c26bf66a8dcfe7ad0193602ed529279d1c5a6aa
SSDEEP

98304:pA47lMQl5tHuC+Eo5EdT9k/6asoCaRN1lMI6jQ:pLMQl5kkokTasoCafDSQ

Score

10^/10

meshagent backdoor discovery execution persistence rat trojan

Malware Config

Targets

- Target
  
  2024-11-07_1db373b17f59735e466cf096f4a3b2a1_frostygoop_luca-stealer_poet-rat_snatch
- Size
  
  7.1MB
- MD5
  
  1db373b17f59735e466cf096f4a3b2a1
- SHA1
  
  4dda405e028d69406cb6b870ed5a7d9e45a9a122
- SHA256
  
  0c30201fa247ef384098a2360270280d73fb1cea17f4e0f9d1b829dcab620b85
- SHA512
  
  ae391e3c8965a24dce1b1802907f59729a3ed7b93a7fdbda9f9fe00a5a6a6a43227556f87c8957a8ba2a0a8f4c26bf66a8dcfe7ad0193602ed529279d1c5a6aa
- SSDEEP
  
  98304:pA47lMQl5tHuC+Eo5EdT9k/6asoCaRN1lMI6jQ:pLMQl5kkokTasoCafDSQ
Score

10^/10

meshagent backdoor discovery execution persistence rat trojan
- Detects MeshAgent payload
- MeshAgent
  MeshAgent is an open source remote access trojan written in C++.
  rat trojan backdoor meshagent
- Meshagent family
  meshagent
- Sets service image path in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

meshagentbackdoordiscoveryexecutionpersistencerattrojan