Overview

overview

10

Static

static

10

meshagent3...ng.exe

windows10-ltsc_2021-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    meshagent32-testing.exe
  • Size 3.7MB
  • Sample260814-mc49nahp3v
  • SHA256 f6486a47a4a60a35bb8d465679394ae898f8f4f93aec8497b6897d0d97f6901d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
meshagenttestingbackdoordiscoveryexecutionpersistencerattrojan

Malware Config

Extracted

Family

  • meshagent

Version

  • 2

Botnet

  • testing

C2

  • http://sunnycat.ct8.pl:443/agent.ashx

Attributes
  • mesh_id

    0x2906C6B4FB98DB2CEF49196B7ED8EF89243F4132DC91051297812E6968B881BA9315638D0C5832ADDF8DAF851A066561

  • server_id

    75E1A2DF3D76020F22C842894E2581885682C535AE46498263DD1EFF75D30CE6C5F412550C4D78B038EAB1F527CCE9F6

  • wss

    wss://sunnycat.ct8.pl:443/agent.ashx

Targets

    • Target
      meshagent32-testing.exe
    • Size 3.7MB
    • SHA256 f6486a47a4a60a35bb8d465679394ae898f8f4f93aec8497b6897d0d97f6901d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    backdoortestingdiscoveryexecutionmeshagentpersistencerattrojan

    • Detects MeshAgent payload

    • Family: MeshAgent

      MeshAgent is an open source remote access trojan written in C++.

      rattrojanbackdoormeshagent

    • Sets service image path in registry

      This determines the executable launched when a service starts. It can be used to establish persistence.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks