Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

meshcmd.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    meshcmd.exe

  • Size

    4.1MB

  • Sample

    250319-14aq1syqw2

  • MD5

    b8d633d731051f9095ba02cde40271c9

  • SHA1

    100f773094541684597d90d2c393febb963b1cde

  • SHA256

    1f8d1578e21fc517274e3a560c57a765b622ea907d0a3ba926b28be4e8ee4abd

  • SHA512

    4f39f2ac9f813bb50d70d788b5f82959e16a1e2d98b5a2559ea5b40b4be724b686d13a3f74cf0c2f1a6bae216861d2a89d776bb65cc62a72e70b37dbc66ed74e

  • SSDEEP

    49152:6dZEy2B6vflQf6X8uZQoy3vR6QVQy5Z+bm4M/HMFvfGW0/wZ7IbOjxw57OSghLOT:CHvfGfZvZj1/N/z/AwpD5

Score
10/10
meshagenttestformebackdoordefense_evasiondiscoverypersistencerattrojan

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

testforme

Attributes
  • mesh_id

    0x74027A312B0AB84E62227EC7C3E867458E9AD873985FAC23F0F8E783CD81F70E77DFC0CB7FFBA5E22349C40190A873E9

  • server_id

    6BCD039A3454760E09EE7BFA6EB2A0F65A5F903D90EBA25FEA531F167630DF6B89F39F9E1CEF9D75CAD4B57AC61E0644

  • wss

    localhost

Targets

    • Target

      meshcmd.exe

    • Size

      4.1MB

    • MD5

      b8d633d731051f9095ba02cde40271c9

    • SHA1

      100f773094541684597d90d2c393febb963b1cde

    • SHA256

      1f8d1578e21fc517274e3a560c57a765b622ea907d0a3ba926b28be4e8ee4abd

    • SHA512

      4f39f2ac9f813bb50d70d788b5f82959e16a1e2d98b5a2559ea5b40b4be724b686d13a3f74cf0c2f1a6bae216861d2a89d776bb65cc62a72e70b37dbc66ed74e

    • SSDEEP

      49152:6dZEy2B6vflQf6X8uZQoy3vR6QVQy5Z+bm4M/HMFvfGW0/wZ7IbOjxw57OSghLOT:CHvfGfZvZj1/N/z/AwpD5

    Score
    10/10
    meshagenttestformebackdoordefense_evasiondiscoverypersistencerattrojan

    • Detects MeshAgent payload

    • MeshAgent

      MeshAgent is an open source remote access trojan written in C++.

      rattrojanbackdoormeshagent

    • Meshagent family

      meshagent

    • Downloads MZ/PE file

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks