General

  • Target

    2025-06-05_d469d249f7a4d49aa3638425e3279446_cobalt-strike_frostygoop_hijackloader_luca-stealer_poet-rat_sliver_snatch

  • Size

    5.0MB

  • Sample

    250605-mkhqmadk6s

  • MD5

    d469d249f7a4d49aa3638425e3279446

  • SHA1

    2031182ed9fef02bf4dfbeb99c7b70194314d3ca

  • SHA256

    02cdca61805165e67c5cc9f1ab16d727bb7f995fb650d158c817ad2725b558eb

  • SHA512

    7368308193a24d115ab6350aa590785eec8af0b9748c2ae64b05a367082e113a990394dc8b9ea9c173fa64bac6a5b960d141c08e88528c41a7b3cd3ad51f374b

  • SSDEEP

    49152:4Rg0nHs3wQuuhrb/T8vO90d7HjmAFd4A64nsfJ4RLvXW4uyRcH5gPZCNsgxocMCb:D3wQuus1n25C1gxtrEb+etU

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

TacticalRMM

C2

http://mesh.renovatiotech.com.br:443/agent.ashx

Attributes
  • mesh_id

    0x6A2D9AEB5513024CF708BDF8C82BCACF8ECA5A8CBEBAAEB3F12D5A2882A814E871383ED720A2C4159F544587F97232D3

  • server_id

    15B26B4A6DB9C20E83F4A977ED2757928D56DEDECC6149A94D6CBF25CC5AF3F35C1630BCC04A7A3D23079C9E23BD624D

  • wss

    wss://mesh.renovatiotech.com.br:443/agent.ashx

Targets

    • Target

      2025-06-05_d469d249f7a4d49aa3638425e3279446_cobalt-strike_frostygoop_hijackloader_luca-stealer_poet-rat_sliver_snatch

    • Size

      5.0MB

    • MD5

      d469d249f7a4d49aa3638425e3279446

    • SHA1

      2031182ed9fef02bf4dfbeb99c7b70194314d3ca

    • SHA256

      02cdca61805165e67c5cc9f1ab16d727bb7f995fb650d158c817ad2725b558eb

    • SHA512

      7368308193a24d115ab6350aa590785eec8af0b9748c2ae64b05a367082e113a990394dc8b9ea9c173fa64bac6a5b960d141c08e88528c41a7b3cd3ad51f374b

    • SSDEEP

      49152:4Rg0nHs3wQuuhrb/T8vO90d7HjmAFd4A64nsfJ4RLvXW4uyRcH5gPZCNsgxocMCb:D3wQuus1n25C1gxtrEb+etU

    • Detects MeshAgent payload

    • MeshAgent

      MeshAgent is an open source remote access trojan written in C++.

    • Meshagent family

    • Blocklisted process makes network request

    • Sets service image path in registry

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks