meshagent | 71a1650c79da5eaec3a3b3cbec63d3df2e939a18e53a95c377f89ae3aa0bc914

Sharing

Copy URL Twitter E-mail

General

Target
71a1650c79da5eaec3a3b3cbec63d3df2e939a18e53a95c377f89ae3aa0bc914
Size 3.7MB
Sample260509-l3ftbaew21
SHA256 71a1650c79da5eaec3a3b3cbec63d3df2e939a18e53a95c377f89ae3aa0bc914
MD5 f7a2e14e37c9ef7b2a8b3d74bd52c864
SHA1 ef72d804d2aec7c84fc8c921400da82948286e35
SHA512 641aea7b5f5f12e6bdcf22bf18a32cfc88bddf52a4b47ebd7998b084d7d3038ded6df5f3445e815980d9229323721a6139667ce5f6df90f80c1aad23c503f7bf
SSDEEP 49152:lfEV3ugKeuWoAkf6bRexQlNIdwB0pJCWJ0+1NaZPwq+5bWZPaE:lfEYnnfKthWq+1jJWZPaE
TLSH
T14306AEC3BB834471F8A736B411AB53BE9D7D69530728D4C393D428A949316D0AE3B39B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ozon rat trojan backdoor meshagent

Malware Config

Extracted

Family

meshagent

Version

Botnet

ozon

Attributes

mesh_id
0x57546D5B3CEC73CEDD7492B5E146352C2BB6D2F4533C91C43216273E9AD7035644E201B470069914D893CFFE9EC8598E
server_id
6C34CD50810F464366F70DDDE0DE5FD3080BF629C10879D03D45D10B253331C81ED7E240B61E61012DF85F77CF5C034F
wss
localhost

Signatures

Family: MeshAgent
MeshAgent is an open source remote access trojan written in C++.
rat trojan backdoor meshagent

Detects MeshAgent payload 1 IoCs

resource	yara_rule
sample	family_meshagent

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
71a1650c79da5eaec3a3b3cbec63d3df2e939a18e53a95c377f89ae3aa0bc914

File Explorer

71a1650c79da5eaec3a3b3cbec63d3df2e939a18e53a95c377f89ae3aa0bc914

.exe 3.7MB

71a1650c79da5eaec3a3b3cbec63d3df2e939a18e53a95c377f89ae3aa0bc914

IMPHASH 7aa58492bf5691114c98568704d048cd
SHA256 71a1650c79da5eaec3a3b3cbec63d3df2e939a18e53a95c377f89ae3aa0bc914
MD5 f7a2e14e37c9ef7b2a8b3d74bd52c864
SHA1 ef72d804d2aec7c84fc8c921400da82948286e35
SHA512 641aea7b5f5f12e6bdcf22bf18a32cfc88bddf52a4b47ebd7998b084d7d3038ded6df5f3445e815980d9229323721a6139667ce5f6df90f80c1aad23c503f7bf
SSDEEP 49152:lfEV3ugKeuWoAkf6bRexQlNIdwB0pJCWJ0+1NaZPwq+5bWZPaE:lfEYnnfKthWq+1jJWZPaE
TLSH
T14306AEC3BB834471F8A736B411AB53BE9D7D69530728D4C393D428A949316D0AE3B39B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects MeshAgent payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1841072

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\MeshAgent\MeshAgent\Release\MeshService.pdb

comctl32

InitCommonControlsEx

crypt32

CryptEncodeObject CertDuplicateCertificateContext CertEnumCertificatesInStore CertDeleteCertificateFromStore CryptAcquireCertificatePrivateKey CertAddEncodedCertificateToStore CryptMsgClose CryptMsgUpdate CryptExportPublicKeyInfo CertCreateSelfSignCertificate CertFreeCertificateContext CryptMsgOpenToEncode CertAddCertificateContextToStore CryptMsgOpenToDecode CryptMsgControl CertStrToNameW CertOpenStore CryptMsgCalculateEncodedLength CertFindCertificateInStore CertSetCertificateContextProperty CertGetCertificateContextProperty CryptMsgGetParam CertStrToNameA CertCloseStore CryptSignAndEncodeCertificate PFXExportCertStore

ncrypt

NCryptCreatePersistedKey BCryptGetProperty BCryptOpenAlgorithmProvider NCryptOpenStorageProvider BCryptCreateHash NCryptSetProperty BCryptHashData NCryptFreeObject NCryptFinalizeKey BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGenRandom

dbghelp

SymInitialize SymFromAddr MiniDumpWriteDump SymGetModuleBase64 SymGetLineFromAddr64 SymFunctionTableAccess64 StackWalk64

iphlpapi

GetAdaptersAddresses SendARP ConvertLengthToIpv4Mask GetAdaptersInfo

ws2_32

__WSAFDIsSet htons htonl gethostname ntohs ntohl WSAGetLastError ioctlsocket recv send gethostbyname getaddrinfo freeaddrinfo getnameinfo WSASetLastError getsockname WSASocketW listen closesocket bind accept WSACleanup FreeAddrInfoW select WSACloseEvent WSACreateEvent WSAStartup WSAEventSelect WSAResetEvent GetAddrInfoW WSAIoctl shutdown connect recvfrom getsockopt sendto socket setsockopt

gdiplus

GdipCloneImage GdipAlloc GdiplusStartup GdiplusShutdown GdipDisposeImage GdipLoadImageFromStreamICM GdipFree GdipGetImageEncodersSize GdipSaveImageToStream GdipLoadImageFromStream GdipGetImageEncoders

kernel32

InterlockedPushEntrySList InterlockedFlushSList RtlUnwind EnterCriticalSection GetFullPathNameW GetStdHandle WriteFile LoadLibraryExA GetModuleFileNameW GetSystemPowerStatus OpenProcess MultiByteToWideChar Sleep GetLastError CloseHandle GetCurrentDirectoryW SetCurrentDirectoryW GetProcAddress SetEnvironmentVariableA CreateProcessW FreeLibrary WideCharToMultiByte GetCurrentThreadId GetModuleHandleA WaitForSingleObjectEx CreateThread QueueUserAPC OpenThread ReadFile LoadLibraryA SleepEx SetSystemPowerState GetCurrentProcess SetThreadExecutionState HeapFree HeapAlloc GetProcessHeap SystemTimeToFileTime GetSystemTime FileTimeToSystemTime LeaveCriticalSection SystemTimeToTzSpecificLocalTime QueryPerformanceCounter ReleaseSemaphore WaitForSingleObject CreateSemaphoreA CancelIo FindFirstFileW FindNextFileW RemoveDirectoryW GetFinalPathNameByHandleW GetDriveTypeA SetFilePointer FindFirstVolumeA FindClose CreateFileW GetVolumePathNamesForVolumeNameA GetFileAttributesExW ReadDirectoryChangesW FindNextVolumeA FindVolumeClose GetDiskFreeSpaceExA CreateEventA GetModuleHandleExA WaitForMultipleObjectsEx CreateNamedPipeA DisconnectNamedPipe CreateFileA CancelIoEx LocalFree ConnectNamedPipe SetConsoleMode GetConsoleMode GetStartupInfoW IsDebuggerPresent TerminateProcess GetTempPathW CancelSynchronousIo SetEvent ResetEvent GetThreadId GetCurrentProcessId GetEnvironmentStrings FreeEnvironmentStringsA CopyFileW MoveFileW RtlCaptureContext SuspendThread ResumeThread DuplicateHandle ExitThread GetTickCount64 GetCurrentThread DeleteFileA GetOverlappedResult GetThreadContext WTSGetActiveConsoleSessionId GetExitCodeProcess SetEndOfFile DeleteFileW SetFilePointerEx SetConsoleCtrlHandler FreeConsole LoadLibraryExW SetLastError GetFileType GetModuleHandleW FormatMessageW SwitchToFiber DeleteFiber CreateFiber GetSystemTimeAsFileTime ConvertFiberToThread ConvertThreadToFiber GetEnvironmentVariableW ReadConsoleA ReadConsoleW DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW CreateProcessA HeapValidate GetSystemInfo CreateDirectoryW GetConsoleCP MoveFileExW SetEnvironmentVariableW SetCurrentDirectoryA GetCurrentDirectoryA GetTimeZoneInformation SetStdHandle GetDriveTypeW PeekNamedPipe GetModuleFileNameA GetCommandLineA GetCommandLineW GetACP RaiseException GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter SetConsoleOutputCP IsProcessorFeaturePresent GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers HeapReAlloc HeapSize HeapQueryInformation GetStringTypeW WriteConsoleW GetCPInfo GetFullPathNameA OutputDebugStringA OutputDebugStringW FindFirstFileExA FindFirstFileExW FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW EncodePointer QueryPerformanceFrequency DecodePointer

user32

EndDialog SetWindowTextW GetWindowPlacement ShowWindow GetDlgCtrlID SetWindowPlacement SetWindowTextA IsDlgButtonChecked GetDlgItem CheckDlgButton DialogBoxParamW EnableWindow MessageBeep ExitWindowsEx GetUserObjectInformationA EnumDisplayMonitors GetSystemMetrics SetThreadDesktop GetThreadDesktop CloseDesktop BlockInput GetMonitorInfoA OpenInputDesktop GetKeyState GetMessageA GetWindowRect SendMessageW LoadCursorA DestroyWindow GetDC PostMessageA GetIconInfo CallNextHookEx GetCursorInfo SetWindowsHookExA MapVirtualKeyA GetForegroundWindow UnhookWindowsHookEx DefWindowProcA CreateWindowExA TranslateMessage UnregisterClassA DrawIconEx SetWinEventHook RegisterClassExA UnhookWinEvent SetForegroundWindow ReleaseDC SendInput SetProcessDPIAware GetProcessWindowStation GetUserObjectInformationW DispatchMessageA CreateWindowExW MessageBoxW GetMessageExtraInfo

gdi32

DeleteObject GetDIBits CreateCompatibleDC SelectObject CreateCompatibleBitmap SetStretchBltMode DeleteDC StretchBlt BitBlt GetObjectA CreateSolidBrush SetBkColor SetBkMode SetTextColor GetStockObject

advapi32

RegOpenKeyExA RegCloseKey CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource StartServiceCtrlDispatcherA QueryServiceStatus CloseServiceHandle AllocateAndInitializeSid SetServiceStatus OpenSCManagerA RegisterServiceCtrlHandlerExA FreeSid CheckTokenMembership OpenServiceA SetTokenInformation CreateProcessAsUserW DuplicateTokenEx SetSecurityDescriptorDacl SetEntriesInAclA InitializeSecurityDescriptor CryptDestroyKey RegQueryValueExA RegSetValueExW RegOpenKeyExW RegQueryValueExW CryptReleaseContext AdjustTokenPrivileges LookupPrivilegeValueA InitiateSystemShutdownA RegCreateKeyW RegSetValueExA RegDeleteKeyA OpenProcessToken

shell32

ShellExecuteExW

ole32

CoCreateInstance CreateStreamOnHGlobal CoInitializeEx CoUninitialize

oleaut32

SysAllocString SysFreeString SysStringLen