Extracted

• • Target

    azd.exe

  • Size

    4.5MB

  • MD5

    f65b789211ab3821e1864f01bc9cacb3

  • SHA1

    b5ac7b515e839a06844a39a5218b4e10d5513c39

  • SHA256

    0c734b30df8049aba666a808f802c5daf9bbde44c05048fd6ed1a120fd351c59

  • SHA512

    da134992d45e3ee76d69b6f6dcb05c0eec4f56d183bc4a3374d5543c5f6c9ad9be51fee5a9989b505d278767f54024789765430b97b550e57b715eaa7cf29c81

  • SSDEEP

    49152:rX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85QJvj:rlRsZ47/QXoHUOfAoj1x6l

  Score

  10^/10

  meshagenttestbackdoordiscoverypersistencerattrojan

  • Detects MeshAgent payload

  • MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

    rattrojanbackdoormeshagent

  • Meshagent family

    meshagent

  • Sets service image path in registry

    persistence

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2