Extracted

• • Target

    start.hta

  • Size

    2KB

  • MD5

    72f081c2a85a3b7ff6fdf4ec84223142

  • SHA1

    62b7fc52e1da16e69314f873e20db6f21135be8c

  • SHA256

    f6f4ab1036beaf92827bdfb23c1332990797515d8a5832c9671962376a24d74b

  • SHA512

    6ccb132bea970b4cdae18b42320770557025d05a05b2e5398392ab8de47595f07b50d42f1f2f03b1da258b7fe872d3432eef7aa04f90025596cda22acfa5308b

  Score

  10^/10

  discoveryexecutionmeshagentworkbackdoorratspywarestealertrojan

  • Detects MeshAgent payload

  • MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

    rattrojanbackdoormeshagent

  • Meshagent family

    meshagent

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  behavioral1behavioral2