meshagent | 2cb2f45cfdecd8e77237648294008626c997a5aa7f2a1d11be6750929319ce2c[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
2cb2f45cfdecd8e77237648294008626c997a5aa7f2a1d11be6750929319ce2c.bin
Size 3.7MB
Sample260803-3aav2assbv
SHA256 2cb2f45cfdecd8e77237648294008626c997a5aa7f2a1d11be6750929319ce2c
MD5 f937c0214121df16e475bf74ab8186aa
SHA1 24b6123b5260c273166df9721f16580510c0df6a
SHA512 4642dada2cfde13fa6033f5f9ea7cb6a65d0a6fe1f68018628a84baa90c53378c5331e551f7181a94eac9d374da0883ff880048b7ec6309997afbaeea1630208
SSDEEP 49152:QNS2PF6/S6QfJeZ+UawYjUAiwTtq3VFszQvZ/+OKc+ZPAqT5f9jJ:n2PFXLOa7tiNWMQOKp991
TLSH
T1AB06AEC2BB834471F8A736B411AB53BE5D7D69530328D4C397D429E98C316D0AE3B39A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

fun test rat trojan backdoor meshagent

Malware Config

Extracted

Family

meshagent

Version

Botnet

FUN Test

http://funbz.fun-bildung.com:443/agent.ashx

Attributes

mesh_id
0x6FA1B620B5ED1499B7A338E532FBC52A4914FF815C00B138006ED5A42DBC95B85241D16CFFAD9D564D8C19E02F1D1B1D
server_id
9C42C886700B5D3445B40AA9A6EC8EC9D4E61A1CF299241D6F10E7941F33BD7CD3FF147F94497CB29172E7F005FD6908
wss
wss://funbz.fun-bildung.com:443/agent.ashx

Signatures

Family: MeshAgent
MeshAgent is an open source remote access trojan written in C++.
rat trojan backdoor meshagent

Detects MeshAgent payload 1 IoCs

resource	yara_rule
sample	family_meshagent

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2cb2f45cfdecd8e77237648294008626c997a5aa7f2a1d11be6750929319ce2c.bin

File Explorer

2cb2f45cfdecd8e77237648294008626c997a5aa7f2a1d11be6750929319ce2c.bin

.exe 3.7MB

2cb2f45cfdecd8e77237648294008626c997a5aa7f2a1d11be6750929319ce2c.bin

IMPHASH ce76bef61a1e81509096f4a563ffeddc
SHA256 2cb2f45cfdecd8e77237648294008626c997a5aa7f2a1d11be6750929319ce2c
MD5 f937c0214121df16e475bf74ab8186aa
SHA1 24b6123b5260c273166df9721f16580510c0df6a
SHA512 4642dada2cfde13fa6033f5f9ea7cb6a65d0a6fe1f68018628a84baa90c53378c5331e551f7181a94eac9d374da0883ff880048b7ec6309997afbaeea1630208
SSDEEP 49152:QNS2PF6/S6QfJeZ+UawYjUAiwTtq3VFszQvZ/+OKc+ZPAqT5f9jJ:n2PFXLOa7tiNWMQOKp991
TLSH
T1AB06AEC2BB834471F8A736B411AB53BE5D7D69530328D4C397D429E98C316D0AE3B39A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects MeshAgent payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1841472

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Default.DESKTOP-9CGK2DI\Desktop\AmtWebApp\MeshAgent\Release\MeshService.pdb

comctl32

InitCommonControlsEx

crypt32

CertSetCertificateContextProperty CertDuplicateCertificateContext CertDeleteCertificateFromStore CryptAcquireCertificatePrivateKey CertAddEncodedCertificateToStore CryptMsgClose CryptMsgUpdate CryptExportPublicKeyInfo CertCreateSelfSignCertificate CertFreeCertificateContext CryptMsgOpenToEncode CertAddCertificateContextToStore CryptMsgOpenToDecode CryptMsgControl PFXExportCertStore CertEnumCertificatesInStore CertOpenSystemStoreW CertStrToNameW CertOpenStore CryptMsgCalculateEncodedLength CertFindCertificateInStore CertGetCertificateContextProperty CryptEncodeObject CryptMsgGetParam CertStrToNameA CertCloseStore CryptSignAndEncodeCertificate

ncrypt

NCryptCreatePersistedKey BCryptGetProperty BCryptOpenAlgorithmProvider NCryptOpenStorageProvider BCryptCreateHash NCryptSetProperty BCryptHashData NCryptFreeObject NCryptFinalizeKey BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGenRandom

dbghelp

SymInitialize SymFromAddr MiniDumpWriteDump SymGetModuleBase64 SymGetLineFromAddr64 SymFunctionTableAccess64 StackWalk64

iphlpapi

GetAdaptersAddresses SendARP ConvertLengthToIpv4Mask GetAdaptersInfo

ws2_32

__WSAFDIsSet htons htonl gethostname ntohs ntohl WSAGetLastError ioctlsocket recv send gethostbyname getaddrinfo freeaddrinfo getnameinfo WSASetLastError getsockname WSASocketW listen closesocket bind accept WSACleanup FreeAddrInfoW select WSACloseEvent WSACreateEvent WSAStartup WSAEventSelect WSAResetEvent GetAddrInfoW WSAIoctl shutdown connect recvfrom getsockopt sendto socket setsockopt

gdiplus

GdipCloneImage GdiplusShutdown GdipGetImageEncoders GdipDisposeImage GdipLoadImageFromStreamICM GdipFree GdipGetImageEncodersSize GdipSaveImageToStream GdipLoadImageFromStream GdiplusStartup GdipAlloc

kernel32

InterlockedPushEntrySList InterlockedFlushSList RtlUnwind EnterCriticalSection LeaveCriticalSection GetFullPathNameW GetStdHandle WriteFile LoadLibraryExA GetModuleFileNameW GetSystemPowerStatus OpenProcess MultiByteToWideChar Sleep GetLastError CloseHandle GetCurrentDirectoryW SetCurrentDirectoryW GetProcAddress SetEnvironmentVariableA CreateProcessW FreeLibrary WideCharToMultiByte GetCurrentThreadId GetModuleHandleA WaitForSingleObjectEx CreateThread QueueUserAPC OpenThread ReadFile LoadLibraryA SleepEx SetSystemPowerState GetCurrentProcess SetThreadExecutionState HeapFree HeapAlloc GetProcessHeap SystemTimeToFileTime GetSystemTime DeleteCriticalSection QueryPerformanceFrequency SystemTimeToTzSpecificLocalTime QueryPerformanceCounter ReleaseSemaphore WaitForSingleObject CreateSemaphoreA CancelIo FindFirstFileW FindNextFileW RemoveDirectoryW GetFinalPathNameByHandleW GetDriveTypeA SetFilePointer FindFirstVolumeA FindClose CreateFileW GetVolumePathNamesForVolumeNameA GetFileAttributesExW ReadDirectoryChangesW FindNextVolumeA FindVolumeClose GetDiskFreeSpaceExA CreateEventA GetModuleHandleExA WaitForMultipleObjectsEx CreateNamedPipeA DisconnectNamedPipe CreateFileA CancelIoEx LocalFree ConnectNamedPipe SetConsoleMode GetStartupInfoW SetConsoleOutputCP IsDebuggerPresent TerminateProcess GetTempPathW CancelSynchronousIo SetEvent ResetEvent GetThreadId GetCurrentProcessId GetEnvironmentStrings FreeEnvironmentStringsA CopyFileW MoveFileW RtlCaptureContext SuspendThread ResumeThread DuplicateHandle ExitThread GetTickCount64 GetCurrentThread DeleteFileA GetOverlappedResult GetThreadContext WTSGetActiveConsoleSessionId GetExitCodeProcess SetEndOfFile DeleteFileW SetFilePointerEx SetConsoleCtrlHandler FreeConsole LoadLibraryExW SetLastError GetFileType GetModuleHandleW FormatMessageW SwitchToFiber DeleteFiber CreateFiber GetSystemTimeAsFileTime ConvertFiberToThread ConvertThreadToFiber GetEnvironmentVariableW ReadConsoleA ReadConsoleW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW CreateProcessA HeapValidate GetSystemInfo CreateDirectoryW GetConsoleCP MoveFileExW SetEnvironmentVariableW SetCurrentDirectoryA GetCurrentDirectoryA GetTimeZoneInformation SetStdHandle GetDriveTypeW PeekNamedPipe GetModuleFileNameA GetCommandLineA GetCommandLineW GetACP RaiseException GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetConsoleMode InitializeSListHead GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers HeapReAlloc HeapSize HeapQueryInformation GetStringTypeW WriteConsoleW GetCPInfo GetFullPathNameA OutputDebugStringA OutputDebugStringW FindFirstFileExA FindFirstFileExW FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW EncodePointer FileTimeToSystemTime DecodePointer

user32

EndDialog SetWindowTextW GetWindowPlacement ShowWindow GetDlgCtrlID SetWindowPlacement SetWindowTextA IsDlgButtonChecked GetDlgItem CheckDlgButton DialogBoxParamW EnableWindow MessageBeep ExitWindowsEx GetUserObjectInformationA EnumDisplayMonitors GetSystemMetrics SetThreadDesktop GetThreadDesktop CloseDesktop BlockInput GetMonitorInfoA OpenInputDesktop GetKeyState GetMessageA GetMessageExtraInfo SendMessageW LoadCursorA DestroyWindow GetDC PostMessageA GetIconInfo CallNextHookEx GetCursorInfo SetWindowsHookExA MapVirtualKeyA GetForegroundWindow UnhookWindowsHookEx DefWindowProcA CreateWindowExA TranslateMessage UnregisterClassA DrawIconEx SetWinEventHook RegisterClassExA UnhookWinEvent SetForegroundWindow ReleaseDC SendInput SetProcessDPIAware MessageBoxW GetUserObjectInformationW GetProcessWindowStation DispatchMessageA CreateWindowExW GetWindowRect

gdi32

DeleteObject GetDIBits CreateCompatibleDC SelectObject CreateCompatibleBitmap SetStretchBltMode DeleteDC StretchBlt BitBlt GetObjectA CreateSolidBrush SetBkColor SetBkMode SetTextColor GetStockObject

advapi32

RegDeleteKeyA RegSetValueExA CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource StartServiceCtrlDispatcherA QueryServiceStatus CloseServiceHandle AllocateAndInitializeSid SetServiceStatus OpenSCManagerA RegisterServiceCtrlHandlerExA FreeSid CheckTokenMembership OpenServiceA SetTokenInformation CreateProcessAsUserW DuplicateTokenEx SetSecurityDescriptorDacl SetEntriesInAclA InitializeSecurityDescriptor CryptDestroyKey RegQueryValueExA RegSetValueExW RegOpenKeyExW RegQueryValueExW CryptReleaseContext AdjustTokenPrivileges LookupPrivilegeValueA InitiateSystemShutdownA OpenProcessToken RegOpenKeyExA RegCreateKeyW RegCloseKey

shell32

ShellExecuteExW

ole32

CoInitializeEx CreateStreamOnHGlobal CoUninitialize CoCreateInstance

oleaut32

SysFreeString SysAllocString SysStringLen