Extracted

• • Target
    a.bat
  • Size 228B
  • SHA256 1bb1c2c4be89e0c88563bb0fccee5e16ff910695bba78c8c43f3259d3f3f8ff0
  • MD5 f0d3a7e85367282e9f57c7e561a67c3e
  • SHA1 a6bc65e26ef3bff3a53b017f1a4273f420f3f2b8
  • SHA512 8fa6a5e8f692d441df0cba8da362d8936193a29adf500ec5c56474275b80e5cabaadb3543473b81007b3ae9c2d15ca3633a3bd8e3ca7bb00a3f5d672040de862
  • MD5 SHA1 SHA512

  Score

  10^/10

  backdoorlnkdiscoveryexecutionmeshagentpersistencerattrojan

  • Detects MeshAgent payload

  • MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

    rattrojanbackdoormeshagent

  • Meshagent family

    meshagent

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Downloads MZ/PE file

  • Sets service image path in registry

    persistence

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2