meshagent | 79540084b562f8daaa91da99cc5fd4173739e6ccf1bcf5355fdfb6ae563f6483

Sharing

Copy URL Twitter E-mail

General

Target
Installer.20-51-0-58.zip
Size 7.2MB
Sample260804-wzzgcsvvbt
SHA256 79540084b562f8daaa91da99cc5fd4173739e6ccf1bcf5355fdfb6ae563f6483
MD5 0933ed499b1d3b6cbe3655965174652f
SHA1 dc016c017b0f4ea5895eecdd039aa38fc82893bb
SHA512 748525d683f7ca123ed45709c09cef0adbfb6b36090578d591596e25a2bed14648673e1570ddbb73df4c6019a8d856025d590a7903c83274f57bb68f53f66dc4
SSDEEP 196608:Mu11MftV2BNhzY01mQn1uJhAYBUxSVHjLkoM2HcaXh5:B1vThznL1urBB8on2EcaXz
TLSH
T1417633C0CCBB1793EF58D409E3B22A2A7F620D1516479D2D616E76362FE32E481276DC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

meshagent

Version

Botnet

http://mesh.sentra.cx:443/agent.ashx

Attributes

mesh_id
0x1598B8CFC6D988991BE49072C91C74EFC1D01A2C2CABFFE75D3B87006EFCE89B4A4265C289CD13391E4B38B9D6C86EEB
server_id
36C343C38E485168014DD640C761E7A01E1F8749544CBEF2C1D83DD38272C20D2112E690F04F6E7C10FF410AF6924190
wss
wss://mesh.sentra.cx:443/agent.ashx

Targets

- Target
  App/beta35805/Installer-20-51-0-58.dll
- Size 1KB
- SHA256 9b8db255de26c751354ce7a7765de9cc071c7a104bc3487fee5624d9bd6bd7de
- MD5 e79f121a4bfff9b2599572ad975ca745
- SHA1 9ebf790ff4c2d0447775718b6c77ff77a1985a16
- SHA512 2e67443514c18e639d16b8e3121aa6459070c9b165abff5bbd25b03b25ec77c242f31ffee1f1aeea476dc2e0752c3922de93396299e607104c51d66b569db68f
- TLSH
  T1DF21502C19FA06AA6173B735980F901B29DF8051420DFA04B2EC8F88AFC0874C107BDF
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  App/beta35805/Installer-20-51-0-58.exe
- Size 17.6MB
- SHA256 c1c84e86807e1a0f0594fae6883f904c958710e8dbeb760249fcc59eec9e9949
- MD5 58b991179f8d4da130a15fbf7c6a5dbe
- SHA1 bfd37182cd581be0f605fea0e15d5fd39fd3d1be
- SHA512 46bbdb276f0fca102748a9f3e524f2588190c26986622a9caea82d444ad7e9bd7da953d40269346e46b561ccf35c577fccfc4a57930f7c47047939bfbedb97ac
- SSDEEP 393216:ouwsDosgM/q+Yv5Yr+ecWxkN0StzZX1zVmEAI9:TDosgM/q+Yv5Yr+ecY6zZlvAI9
- TLSH
  T14D079D13B6D301E1E9A3567004FB622B5637AA12873089CBF25C3A546F732D17B377A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Installer.20-51-0-58.exe
- Size 152KB
- SHA256 9d9dd44c508af2fe864a8264ba5833d7c47fd21fe1b4c72ff6e05f7da94c288f
- MD5 ddc559ab995e489f7ad9c37d3203f0cf
- SHA1 9d32f3248bef553b666e6b3c7e382ab151a16837
- SHA512 4284ee6ba3621a8d90e52ab41fe4f06d10be62a078d87394af24ba3f3b531575b3d897a4676268576924b9d69991f234cc1c98fd94b18df3010a1e1786f2e285
- SSDEEP 3072:HfweqOYEUXPn4tvFGRfIyZR2di/YB+KYzK3pCW6WG:oEUXWvF2fJZR6K+16K3e
- TLSH
  T14CE3D04097F4C072F9F21EB429B19A621EB6FC010875D55FA308DEDE7931AD09D2AB1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor mnb discovery execution meshagent persistence rat trojan
- Detects MeshAgent payload
- Family: MeshAgent
  MeshAgent is an open source remote access trojan written in C++.
  rat trojan backdoor meshagent
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Downloads MZ/PE file
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral5 behavioral6
- Target
  $PLUGINSDIR/MoreInfo.dll
- Size 7KB
- SHA256 227a4fc9408a44faa5eca608a974bd536814f97b8a4d28b4cac479727167b026
- MD5 bd393029cc49b415b6c9aeb8a4936516
- SHA1 c67fd92fffd18941bed41bfd6ac4f3b04fd123df
- SHA512 3bb8e5cf4bea7e8adaa62196e58fff9031f49fd4efa78e5bd3e4b9c4e9ba1523864567521793053595d90abec719761a5964ff3abe04b93b24d52e5ffa4c1f96
- SSDEEP 96:LEjAlUFPxXJugoImuaKbkBSEPTpsxKaVQ4Ad:gjAiFPxXJugoImJKQk8yxKaVVe
- TLSH
  T1EEE1603263F441EDF9DB0B346C334B291D75BC21EA21957F2691098D3DB1A44EE227B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
- MD5 bf712f32249029466fa86756f5546950
- SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
- SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
- SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
- TLSH
  T1DC3229328B60C1F2D561C274496B3A3367B9761420B04D67DFB78446EC16AD66E3E327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/UAC.dll
- Size 13KB
- SHA256 c5ab2926c268257122d0342739e73573d7eeda34c861bc7a68a02cbc69bd41af
- MD5 a88baad3461d2e9928a15753b1d93fd7
- SHA1 bb826e35264968bbc3b981d8430ac55df1e6d4a6
- SHA512 5edcf46680716930da7fd1a41b8b0426f057cf4becefb3ee84798ec8b449726afb822fb626c4942036a1ae3bb937184d1f71d0e45075abb5bf167f5d833df43a
- SSDEEP 192:qP6KdXy+Yo7e1J8qC25a5mDFmCLGUCVGpU6uNck87I0S/TDqwyTq+:q/q3Pgd5mx6VkEck87ILCTN
- TLSH
  T1CC526C5421D84BBFD24156383ADB776346B9FB316C62818FC6A349CB6871693A93E302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/execDos.dll
- Size 5KB
- SHA256 720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f
- MD5 0deb397ca1e716bb7b15e1754e52b2ac
- SHA1 fbb9bcf872c5dbb4ca4c80fb21d41519bc273ef5
- SHA512 507db0bee0897660750007e7ce674406acf9e8bf942cf26ded5654c07682757b07c9eb767bead0966478abc554dc9a6461c4288dc35d12cacfadad4c128f1bb7
- SSDEEP 96:J++xDiP4p7t7dNOt3stxtRFFXxGD6qxlnKE6ttdH3r3:Rx9pJ7jQs5toD6Cln/6tt1
- TLSH
  T153C1E73AF2E409B3C2A806343EA6A42B17F9D02B071409B7876321CC6CD0DB8FE74256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/newadvsplash.dll
- Size 8KB
- SHA256 0a70cc4b93d87ecd93e538cfbed7c9a4b8b5c6f1042c6069757bda0d1279ed06
- MD5 55a723e125afbc9b3a41d46f41749068
- SHA1 01618b26fec6b8c6bdb866e6e4d0f7a0529fe97c
- SHA512 559157fa1b3eb6ae1f9c0f2c71ccc692a0a0affb1d6498a8b8db1436d236fd91891897ac620ed5a588beba2efa43ef064211a7fcadb5c3a3c5e2be1d23ef9d4c
- SSDEEP 96:/VV0Rwtvrm2nQujIvP9dir3UniV/zRzVR3rN3k8Jd18tsPcaqhx:/VV0KtC2yH9d83BzVR53kEQFaq
- TLSH
  T17702C73972C169F3D26B05F82D526B2E0FEEA035135650228B33A4DA3DA0353FD26747
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/newtextreplace.dll
- Size 11KB
- SHA256 156b9b583399faf13c4d46b89339fb0f7f38dc847ac2d7872178d8e3998b9734
- MD5 b5358341df2cb171876a5f201e31a834
- SHA1 df34750ea5504274be5ff8ddd306b49e302d04f9
- SHA512 821dc42e24fa2d44a1d4d16b26c3da2688dac0fa44a266e38da2aff706c91440d83a87abc74131930e6c38a44a0c5e627db2d045375fde147e0edd3276f4b014
- SSDEEP 192:GGhRfigbU26niqo9m+9k15AA1NrW0QfaDx3nxNLr6s+:GIwgSnhv/IaDx3n6X
- TLSH
  T11832965F729645F6EA2259B00FCFF67B8E90C005402B4F6CB79A896CB933E84710D195
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
- MD5 132e6153717a7f9710dcea4536f364cd
- SHA1 e39bc82c7602e6dd0797115c2bd12e872a5fb2ab
- SHA512 9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1
- SSDEEP 96:M/SspqrIYxLPEQhThvov3TE4/2Sa5P9QFFYzOx4uF3sbSEI5LP39sQvM:M/QUG7lhvov36S5FcUjliSEI5LuQ
- TLSH
  T1A4C1E5B656D909F3E41D00B83E31241F43FEE5260B7A03719E8B2AC61CD2AB6FD58791
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  $PLUGINSDIR/registry.dll
- Size 29KB
- SHA256 acb79c55b3b9c460d032a6f3aaf6c642bf8c1d450e23279d091cc0c6ca510973
- MD5 2880bf3bbbc8dcaeb4367df8a30f01a8
- SHA1 cb5c65eae4ae923514a67c95ada2d33b0c3f2118
- SHA512 ca978702ce7aa04f8d9781a819a57974f9627e969138e23e81e0792ff8356037c300bb27a37a9b5c756220a7788a583c8e40cc23125bcbe48849561b159c4fa3
- SSDEEP 768:HsKZwhFkGOr0Ga4+8DFFHR4mmw5+64fuKwX13:HLKmGOr0Ga4+8DFFHRrmw5+m
- TLSH
  T117D20980D64091A5E4F678FEB7D2633B462D6BB00553A09713F33E57AD68704BB2392E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22