General
-
Target
2025-06-05_d469d249f7a4d49aa3638425e3279446_cobalt-strike_frostygoop_hijackloader_luca-stealer_poet-rat_sliver_snatch
-
Size
5.0MB
-
Sample
250605-mkhqmadk6s
-
MD5
d469d249f7a4d49aa3638425e3279446
-
SHA1
2031182ed9fef02bf4dfbeb99c7b70194314d3ca
-
SHA256
02cdca61805165e67c5cc9f1ab16d727bb7f995fb650d158c817ad2725b558eb
-
SHA512
7368308193a24d115ab6350aa590785eec8af0b9748c2ae64b05a367082e113a990394dc8b9ea9c173fa64bac6a5b960d141c08e88528c41a7b3cd3ad51f374b
-
SSDEEP
49152:4Rg0nHs3wQuuhrb/T8vO90d7HjmAFd4A64nsfJ4RLvXW4uyRcH5gPZCNsgxocMCb:D3wQuus1n25C1gxtrEb+etU
Static task
static1
Behavioral task
behavioral1
Sample
2025-06-05_d469d249f7a4d49aa3638425e3279446_cobalt-strike_frostygoop_hijackloader_luca-stealer_poet-rat_sliver_snatch.exe
Resource
win10v2004-20250502-en
Malware Config
Extracted
meshagent
2
TacticalRMM
http://mesh.renovatiotech.com.br:443/agent.ashx
-
mesh_id
0x6A2D9AEB5513024CF708BDF8C82BCACF8ECA5A8CBEBAAEB3F12D5A2882A814E871383ED720A2C4159F544587F97232D3
-
server_id
15B26B4A6DB9C20E83F4A977ED2757928D56DEDECC6149A94D6CBF25CC5AF3F35C1630BCC04A7A3D23079C9E23BD624D
-
wss
wss://mesh.renovatiotech.com.br:443/agent.ashx
Targets
-
-
Target
2025-06-05_d469d249f7a4d49aa3638425e3279446_cobalt-strike_frostygoop_hijackloader_luca-stealer_poet-rat_sliver_snatch
-
Size
5.0MB
-
MD5
d469d249f7a4d49aa3638425e3279446
-
SHA1
2031182ed9fef02bf4dfbeb99c7b70194314d3ca
-
SHA256
02cdca61805165e67c5cc9f1ab16d727bb7f995fb650d158c817ad2725b558eb
-
SHA512
7368308193a24d115ab6350aa590785eec8af0b9748c2ae64b05a367082e113a990394dc8b9ea9c173fa64bac6a5b960d141c08e88528c41a7b3cd3ad51f374b
-
SSDEEP
49152:4Rg0nHs3wQuuhrb/T8vO90d7HjmAFd4A64nsfJ4RLvXW4uyRcH5gPZCNsgxocMCb:D3wQuus1n25C1gxtrEb+etU
-
Detects MeshAgent payload
-
Meshagent family
-
Blocklisted process makes network request
-
Sets service image path in registry
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1