Extracted

• • Target

    meshagent64-test (3).exe

  • Size

    3.3MB

  • MD5

    fa15b312bb0e5999a2d818f8a4baf0bc

  • SHA1

    f874d91384cfa3bacaaaa33fc1cc6444e007c891

  • SHA256

    ae283e92827c85e5dcf6bbd837ade5fa77b3372b164a21148de99c77a4dbfce9

  • SHA512

    7d0ea6117857331ebe4c98048e84200490423477f884e8c3ea79f34b69ccbb5bdca2178660eb49bcc208e3811642770f2cc57abdbb670c8a0a05b7abdfd785c9

  • SSDEEP

    49152:PdZEy2B6vflQf6X8uZQoy3vR6QVQy5Z+bm4M/HMFvfGW0/7Z7Ib3jxw5b4:1HvfGfZvZj1/N/z/owJ4

  Score

  10^/10

  meshagenttestbackdoordiscoverypersistencerattrojan

  • Detects MeshAgent payload

  • MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

    rattrojanbackdoormeshagent

  • Meshagent family

    meshagent

  • Sets service image path in registry

    persistence

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1