General

  • Target

    2024-11-19_e83fa1c4d6f42821037608ba6c3c7b14_frostygoop_luca-stealer_poet-rat_snatch

  • Size

    5.0MB

  • Sample

    241119-r1wpmsskap

  • MD5

    e83fa1c4d6f42821037608ba6c3c7b14

  • SHA1

    34e76923d3500251a84ef86f43d913d2aaed10ee

  • SHA256

    e316dc3870d3aed2d2330fe74225fabbdd8d5206d1a785713215b668720f12e8

  • SHA512

    22f1c2ebbc5a154722a27707c03a7185d5ef610a82bb5cbc1e3153a56e5a7a799520f0cca2920acd290724e58556bddaa918ffb28311cbfd16bb23e9e198fa6e

  • SSDEEP

    49152:OgvUDWv4e4uPpV1wrb/T8vO90d7HjmAFd4A64nsfJJKyutrDb4HGw1lfVGlJS5Zi:J4e4uPpVm6gTVGIO7DfEa+e7

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

TacticalRMM

C2

http://mesh.pl.promled.info:443/agent.ashx

Attributes
  • mesh_id

    0x69ACC085A7BD213D881483D557B7FA209FA0AA180A06263277FB50D4835A587A2DB02E382246530A11536B07F1588A98

  • server_id

    AFA97A19F77BE549024E0CD3EC628FA4E76B82C750F4571A6506FA5987B1E85368666413E577F70FF492E2558DB44895

  • wss

    wss://mesh.pl.promled.info:443/agent.ashx

Targets

    • Target

      2024-11-19_e83fa1c4d6f42821037608ba6c3c7b14_frostygoop_luca-stealer_poet-rat_snatch

    • Size

      5.0MB

    • MD5

      e83fa1c4d6f42821037608ba6c3c7b14

    • SHA1

      34e76923d3500251a84ef86f43d913d2aaed10ee

    • SHA256

      e316dc3870d3aed2d2330fe74225fabbdd8d5206d1a785713215b668720f12e8

    • SHA512

      22f1c2ebbc5a154722a27707c03a7185d5ef610a82bb5cbc1e3153a56e5a7a799520f0cca2920acd290724e58556bddaa918ffb28311cbfd16bb23e9e198fa6e

    • SSDEEP

      49152:OgvUDWv4e4uPpV1wrb/T8vO90d7HjmAFd4A64nsfJJKyutrDb4HGw1lfVGlJS5Zi:J4e4uPpVm6gTVGIO7DfEa+e7

    • Detects MeshAgent payload

    • MeshAgent

      MeshAgent is an open source remote access trojan written in C++.

    • Meshagent family

    • Blocklisted process makes network request

    • Sets service image path in registry

    • Stops running service(s)

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks