meshagent | meshagent32-Access[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
meshagent32-Access.exe
Size 3.7MB
Sample260303-lllcgaby4e
SHA256 6545b109e575cc3a60d80e7155a4a5f70d770adbe96965cb7e42a2d62ca83043
MD5 067df7cf197945f6aac5413e722d5398
SHA1 c7e02cf4a5acc6a766a5d09d951b3e2e1ed5180e
SHA512 bfb7de632c0c1d29924afaaa6329456466330ff69104d40208a0f07a382d4c049809c0ba249f40042687371207ed9c864235337ab440b8b00aa003738b3ea0bb
SSDEEP 49152:hfEV3ugKeuWoAkf6bRexQlNIdwB0pJCWJ0+1NaZPwq+5bWZPaK:hfEYnnfKthWq+1jJWZPaK
TLSH
T1A906AEC3BB834471F8A736B411AB53BE9D7D69530728D4C393D428A949316D0AE3B39B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

access meshagent

Malware Config

Extracted

Family

meshagent

Version

Botnet

Access

http://az.lsa.az:444/agent.ashx

Attributes

mesh_id
0xB551D33F9968B8F334AE69A015C933B1A9F79868B74E7A1A63CF71B06D8150C48FD381FC3B5797AE231736FF80B3E47A
server_id
A99A9C7B7E30B89F71E9BA5CCFAEC2456BB64A64A35F4780F205ABAD0014AEE6B883CF6316F998EBC54A98188853AD02
wss
wss://az.lsa.az:444/agent.ashx

Signatures

Detects MeshAgent payload 1 IoCs

resource	yara_rule
sample	family_meshagent

Meshagent family
meshagent

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
meshagent32-Access.exe

File Explorer

meshagent32-Access.exe

.exe 3.7MB

meshagent32-Access.exe

IMPHASH 7aa58492bf5691114c98568704d048cd
SHA256 6545b109e575cc3a60d80e7155a4a5f70d770adbe96965cb7e42a2d62ca83043
MD5 067df7cf197945f6aac5413e722d5398
SHA1 c7e02cf4a5acc6a766a5d09d951b3e2e1ed5180e
SHA512 bfb7de632c0c1d29924afaaa6329456466330ff69104d40208a0f07a382d4c049809c0ba249f40042687371207ed9c864235337ab440b8b00aa003738b3ea0bb
SSDEEP 49152:hfEV3ugKeuWoAkf6bRexQlNIdwB0pJCWJ0+1NaZPwq+5bWZPaK:hfEYnnfKthWq+1jJWZPaK
TLSH
T1A906AEC3BB834471F8A736B411AB53BE9D7D69530728D4C393D428A949316D0AE3B39B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects MeshAgent payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1841072

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\MeshAgent\MeshAgent\Release\MeshService.pdb

comctl32

InitCommonControlsEx

crypt32

CryptEncodeObject CertDuplicateCertificateContext CertEnumCertificatesInStore CertDeleteCertificateFromStore CryptAcquireCertificatePrivateKey CertAddEncodedCertificateToStore CryptMsgClose CryptMsgUpdate CryptExportPublicKeyInfo CertCreateSelfSignCertificate CertFreeCertificateContext CryptMsgOpenToEncode CertAddCertificateContextToStore CryptMsgOpenToDecode CryptMsgControl CertStrToNameW CertOpenStore CryptMsgCalculateEncodedLength CertFindCertificateInStore CertSetCertificateContextProperty CertGetCertificateContextProperty CryptMsgGetParam CertStrToNameA CertCloseStore CryptSignAndEncodeCertificate PFXExportCertStore

ncrypt

NCryptCreatePersistedKey BCryptGetProperty BCryptOpenAlgorithmProvider NCryptOpenStorageProvider BCryptCreateHash NCryptSetProperty BCryptHashData NCryptFreeObject NCryptFinalizeKey BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGenRandom

dbghelp

SymInitialize SymFromAddr MiniDumpWriteDump SymGetModuleBase64 SymGetLineFromAddr64 SymFunctionTableAccess64 StackWalk64

iphlpapi

GetAdaptersAddresses SendARP ConvertLengthToIpv4Mask GetAdaptersInfo

ws2_32

__WSAFDIsSet htons htonl gethostname ntohs ntohl WSAGetLastError ioctlsocket recv send gethostbyname getaddrinfo freeaddrinfo getnameinfo WSASetLastError getsockname WSASocketW listen closesocket bind accept WSACleanup FreeAddrInfoW select WSACloseEvent WSACreateEvent WSAStartup WSAEventSelect WSAResetEvent GetAddrInfoW WSAIoctl shutdown connect recvfrom getsockopt sendto socket setsockopt

gdiplus

GdipCloneImage GdipAlloc GdiplusStartup GdiplusShutdown GdipDisposeImage GdipLoadImageFromStreamICM GdipFree GdipGetImageEncodersSize GdipSaveImageToStream GdipLoadImageFromStream GdipGetImageEncoders

kernel32

InterlockedPushEntrySList InterlockedFlushSList RtlUnwind EnterCriticalSection GetFullPathNameW GetStdHandle WriteFile LoadLibraryExA GetModuleFileNameW GetSystemPowerStatus OpenProcess MultiByteToWideChar Sleep GetLastError CloseHandle GetCurrentDirectoryW SetCurrentDirectoryW GetProcAddress SetEnvironmentVariableA CreateProcessW FreeLibrary WideCharToMultiByte GetCurrentThreadId GetModuleHandleA WaitForSingleObjectEx CreateThread QueueUserAPC OpenThread ReadFile LoadLibraryA SleepEx SetSystemPowerState GetCurrentProcess SetThreadExecutionState HeapFree HeapAlloc GetProcessHeap SystemTimeToFileTime GetSystemTime FileTimeToSystemTime LeaveCriticalSection SystemTimeToTzSpecificLocalTime QueryPerformanceCounter ReleaseSemaphore WaitForSingleObject CreateSemaphoreA CancelIo FindFirstFileW FindNextFileW RemoveDirectoryW GetFinalPathNameByHandleW GetDriveTypeA SetFilePointer FindFirstVolumeA FindClose CreateFileW GetVolumePathNamesForVolumeNameA GetFileAttributesExW ReadDirectoryChangesW FindNextVolumeA FindVolumeClose GetDiskFreeSpaceExA CreateEventA GetModuleHandleExA WaitForMultipleObjectsEx CreateNamedPipeA DisconnectNamedPipe CreateFileA CancelIoEx LocalFree ConnectNamedPipe SetConsoleMode GetConsoleMode GetStartupInfoW IsDebuggerPresent TerminateProcess GetTempPathW CancelSynchronousIo SetEvent ResetEvent GetThreadId GetCurrentProcessId GetEnvironmentStrings FreeEnvironmentStringsA CopyFileW MoveFileW RtlCaptureContext SuspendThread ResumeThread DuplicateHandle ExitThread GetTickCount64 GetCurrentThread DeleteFileA GetOverlappedResult GetThreadContext WTSGetActiveConsoleSessionId GetExitCodeProcess SetEndOfFile DeleteFileW SetFilePointerEx SetConsoleCtrlHandler FreeConsole LoadLibraryExW SetLastError GetFileType GetModuleHandleW FormatMessageW SwitchToFiber DeleteFiber CreateFiber GetSystemTimeAsFileTime ConvertFiberToThread ConvertThreadToFiber GetEnvironmentVariableW ReadConsoleA ReadConsoleW DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW CreateProcessA HeapValidate GetSystemInfo CreateDirectoryW GetConsoleCP MoveFileExW SetEnvironmentVariableW SetCurrentDirectoryA GetCurrentDirectoryA GetTimeZoneInformation SetStdHandle GetDriveTypeW PeekNamedPipe GetModuleFileNameA GetCommandLineA GetCommandLineW GetACP RaiseException GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter SetConsoleOutputCP IsProcessorFeaturePresent GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers HeapReAlloc HeapSize HeapQueryInformation GetStringTypeW WriteConsoleW GetCPInfo GetFullPathNameA OutputDebugStringA OutputDebugStringW FindFirstFileExA FindFirstFileExW FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW EncodePointer QueryPerformanceFrequency DecodePointer

user32

EndDialog SetWindowTextW GetWindowPlacement ShowWindow GetDlgCtrlID SetWindowPlacement SetWindowTextA IsDlgButtonChecked GetDlgItem CheckDlgButton DialogBoxParamW EnableWindow MessageBeep ExitWindowsEx GetUserObjectInformationA EnumDisplayMonitors GetSystemMetrics SetThreadDesktop GetThreadDesktop CloseDesktop BlockInput GetMonitorInfoA OpenInputDesktop GetKeyState GetMessageA GetWindowRect SendMessageW LoadCursorA DestroyWindow GetDC PostMessageA GetIconInfo CallNextHookEx GetCursorInfo SetWindowsHookExA MapVirtualKeyA GetForegroundWindow UnhookWindowsHookEx DefWindowProcA CreateWindowExA TranslateMessage UnregisterClassA DrawIconEx SetWinEventHook RegisterClassExA UnhookWinEvent SetForegroundWindow ReleaseDC SendInput SetProcessDPIAware GetProcessWindowStation GetUserObjectInformationW DispatchMessageA CreateWindowExW MessageBoxW GetMessageExtraInfo

gdi32

DeleteObject GetDIBits CreateCompatibleDC SelectObject CreateCompatibleBitmap SetStretchBltMode DeleteDC StretchBlt BitBlt GetObjectA CreateSolidBrush SetBkColor SetBkMode SetTextColor GetStockObject

advapi32

RegOpenKeyExA RegCloseKey CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource StartServiceCtrlDispatcherA QueryServiceStatus CloseServiceHandle AllocateAndInitializeSid SetServiceStatus OpenSCManagerA RegisterServiceCtrlHandlerExA FreeSid CheckTokenMembership OpenServiceA SetTokenInformation CreateProcessAsUserW DuplicateTokenEx SetSecurityDescriptorDacl SetEntriesInAclA InitializeSecurityDescriptor CryptDestroyKey RegQueryValueExA RegSetValueExW RegOpenKeyExW RegQueryValueExW CryptReleaseContext AdjustTokenPrivileges LookupPrivilegeValueA InitiateSystemShutdownA RegCreateKeyW RegSetValueExA RegDeleteKeyA OpenProcessToken

shell32

ShellExecuteExW

ole32

CoCreateInstance CreateStreamOnHGlobal CoInitializeEx CoUninitialize

oleaut32

SysAllocString SysFreeString SysStringLen