meshagent | NF-862[.]exe

General

Target
NF-862.exe
Size 3.7MB
Sample250411-klf73stygw
SHA256 bac580330533d88615cff21f12aed1b8e045034f5f7f98875f2edf4b063fe554
MD5 1a8640a6ab70cfe3f0f1105e6be26209
SHA1 7acb46ccdba8fe42740c5040c720c414d403be85
SHA512 ca7ac8c9753f69ccf81d6f22f98aeef5ebb400ee840fd52e289f2d72c2ea8eb795a14b27d6a59eaaaaa74a8333721cb71963a1e51c8e2b7a16670798b026f097
SSDEEP 49152:sU1//9dZEy2B6vflQf6X8uZQoy3vR6QVQy5Z+bm4M/HMFvfGW0/7Z7Ib3jxW5By:sC///HvfGfZvZj1/N/z/oWLy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

didi meshagent

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

DiDi

C2

http://sso.meusams.club:443/agent.ashx

Attributes

mesh_id
0xD7FD3F4C33B7CBDF80C90F960B93DA9896A7AF6F4291E237C0676771880DB31757B9F4616C39103430052283A8C85E86
server_id
584E50036093A0B958CBECA5492D24BB162BE9A95E1AD0238F79BF6151C23BBDE04F1A3714FA43524AFA79F6650C5638
wss
wss://sso.meusams.club:443/agent.ashx

Signatures

Detects MeshAgent payload 1 IoCs

resource	yara_rule
sample	family_meshagent

Meshagent family
meshagent

File Explorer

NF-862.exe

.exe 3.7MB

NF-862.exe

IMPHASH 20773d650a7c320df274f3a6287f5eb2
SHA256 bac580330533d88615cff21f12aed1b8e045034f5f7f98875f2edf4b063fe554
MD5 1a8640a6ab70cfe3f0f1105e6be26209
SHA1 7acb46ccdba8fe42740c5040c720c414d403be85
SHA512 ca7ac8c9753f69ccf81d6f22f98aeef5ebb400ee840fd52e289f2d72c2ea8eb795a14b27d6a59eaaaaa74a8333721cb71963a1e51c8e2b7a16670798b026f097
SSDEEP 49152:sU1//9dZEy2B6vflQf6X8uZQoy3vR6QVQy5Z+bm4M/HMFvfGW0/7Z7Ib3jxW5By:sC///HvfGfZvZj1/N/z/oWLy
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detects MeshAgent payload

PE Signature issue

Digest

79:d2:74:d2:0a:2b:eb:86:50:0f:55:3c:32:5f:31:f8:51:b2:6c:12:c4:ef:0b:4e:37:45:f5:ca:5c:d8:57:1c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=1220800003160,CN=LLC MISTAKE,O=LLC MISTAKE,STREET=V.I. Lenin st\, 249 premises 301/1,L=Elista,ST=Republic of Kalmykia,C=RU,1.3.6.1.4.1.311.60.2.1.2=#131452657075626c6963206f66204b616c6d796b6961,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Apr 8, 2025

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

SERIALNUMBER=1220800003160,CN=LLC MISTAKE,O=LLC MISTAKE,STREET=V.I. Lenin st\, 249 premises 301/1,L=Elista,ST=Republic of Kalmykia,C=RU,1.3.6.1.4.1.311.60.2.1.2=#131452657075626c6963206f66204b616c6d796b6961,1.3.6.1.4.1.311.60.2.1.3=#13025255,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

5d:35:27:60:09:ec:70:a2:81:8d:3b:24

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 28, 2025 - Mar 29, 2026

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 7, 2023 - Dec 9, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

0

Major OS version

6

Entry point

187712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

nfinstaller.pdb

kernel32

GetTimeZoneInformationForYear GetExitCodeProcess SetFilePointerEx FlushFileBuffers HeapSize GetProcessHeap HeapFree CloseHandle HeapReAlloc GetSystemTimePreciseAsFileTime AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetLastError SetLastError GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetCurrentProcess GetProcAddress GetCurrentProcessId CreateMutexA ReleaseMutex RtlVirtualUnwind WideCharToMultiByte lstrlenW GetStdHandle GetConsoleMode GetConsoleOutputCP WaitForSingleObject MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW GetModuleHandleA CreateWaitableTimerExW SetWaitableTimer Sleep GetModuleHandleW FormatMessageW GetTempPathW GetFullPathNameW CreateFileW SetFileInformationByHandle CreateDirectoryW GetFileInformationByHandle GetFileInformationByHandleEx FindFirstFileExW FindClose CompareStringOrdinal GetSystemDirectoryW GetModuleFileNameW GetWindowsDirectoryW CreateProcessW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileAttributesW DuplicateHandle CreateThread CreateNamedPipeW ReadFileEx SleepEx WriteFileEx HeapAlloc LCMapStringW CompareStringW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader WriteFile ExitProcess TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

bcryptprimitives

ProcessPrng

ntdll

RtlNtStatusToDosError NtWriteFile

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

NF-862.exe

PE Signature issue

kernel32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

ntdll

generic