meshagent | 7850488aea7f4b6659efae64ba7848aa70a4d0902c9a1cabdf6af881e64966af[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
7850488aea7f4b6659efae64ba7848aa70a4d0902c9a1cabdf6af881e64966af.bin
Size 3.3MB
Sample260916-spfdysbd87
SHA256 7850488aea7f4b6659efae64ba7848aa70a4d0902c9a1cabdf6af881e64966af
MD5 47a137281dedd03856de18e7f20ced5f
SHA1 329208bbe0c69256b84b9ef6931c63e0e80de6ef
SHA512 fadbe825f0ac3b5bd815349656402403a4a6d14cc20c479ca0db9a774888fcdfb41838af45ac1472402b60ee18e06ad48f41b9e82c60531902f8515ebbbfa9d0
SSDEEP 49152:8MSGj9zai9bsddr7AaPcZumeRQyKpzSPQBcnMFvf8AC4Z78bRwlI5fw:5d9AddBcryO3cICgI9w
TLSH
T156F57CD2A7A600E8E977F23CC9568517E7F2B81713709BCF25A44A660F236D12B3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

endpoints rat trojan backdoor meshagent

Malware Config

Extracted

Family

meshagent

Version

Botnet

Endpoints

http://maroonexpedition.tech:443/agent.ashx

Attributes

mesh_id
0x1AF68F362A641F44CF1936FCADD5E26A53C5608AD00FE526C872440AB4FB6655175171B67F2007D7C2CBCDC58C49EAA6
server_id
7AE7CB33FCCF09DA2736DA5F74BF587712EF806DDB38EA1AA900E7AC578DC8F899A4B364C654802531E8E810DD1AE6F1
wss
wss://maroonexpedition.tech:443/agent.ashx

Signatures

Family: MeshAgent
MeshAgent is an open source remote access trojan written in C++.
rat trojan backdoor meshagent

Detects MeshAgent payload 1 IoCs

resource	yara_rule
sample	family_meshagent

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7850488aea7f4b6659efae64ba7848aa70a4d0902c9a1cabdf6af881e64966af.bin

File Explorer

7850488aea7f4b6659efae64ba7848aa70a4d0902c9a1cabdf6af881e64966af.bin

.exe 3.3MB

7850488aea7f4b6659efae64ba7848aa70a4d0902c9a1cabdf6af881e64966af.bin

IMPHASH 1beb656f21b9419cba7deef0272fc88b
SHA256 7850488aea7f4b6659efae64ba7848aa70a4d0902c9a1cabdf6af881e64966af
MD5 47a137281dedd03856de18e7f20ced5f
SHA1 329208bbe0c69256b84b9ef6931c63e0e80de6ef
SHA512 fadbe825f0ac3b5bd815349656402403a4a6d14cc20c479ca0db9a774888fcdfb41838af45ac1472402b60ee18e06ad48f41b9e82c60531902f8515ebbbfa9d0
SSDEEP 49152:8MSGj9zai9bsddr7AaPcZumeRQyKpzSPQBcnMFvf8AC4Z78bRwlI5fw:5d9AddBcryO3cICgI9w
TLSH
T156F57CD2A7A600E8E977F23CC9568517E7F2B81713709BCF25A44A660F236D12B3E741
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects MeshAgent payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1942108

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

comctl32

InitCommonControlsEx

dbghelp

SymInitialize SymGetModuleBase64 SymGetLineFromAddr64 SymFunctionTableAccess64 SymFromAddr StackWalk64 MiniDumpWriteDump

iphlpapi

GetAdaptersAddresses SendARP ConvertLengthToIpv4Mask GetAdaptersInfo

ws2_32

WSACloseEvent htons htonl gethostname ntohs ntohl WSAGetLastError ioctlsocket recv send WSASetLastError getsockname WSASocketW listen closesocket bind accept __WSAFDIsSet setsockopt socket sendto getsockopt recvfrom connect shutdown WSAIoctl GetAddrInfoW WSAResetEvent WSAEventSelect WSAStartup WSACreateEvent WSACleanup FreeAddrInfoW select

crypt32

CryptMsgCalculateEncodedLength CertDuplicateCertificateContext CertDeleteCertificateFromStore CryptAcquireCertificatePrivateKey CertAddEncodedCertificateToStore CryptMsgClose CryptMsgUpdate CryptExportPublicKeyInfo CertCreateSelfSignCertificate CertFreeCertificateContext CryptMsgOpenToEncode CertAddCertificateContextToStore PFXExportCertStore CryptSignAndEncodeCertificate CertCloseStore CertStrToNameA CryptMsgGetParam CryptEncodeObject CertSetCertificateContextProperty CertFindCertificateInStore CertGetCertificateContextProperty CertOpenStore CertStrToNameW CertOpenSystemStoreW CertEnumCertificatesInStore

gdiplus

GdipGetImageEncoders GdiplusShutdown GdipCloneImage GdipAlloc GdipDisposeImage GdipFree GdipGetImageEncodersSize GdipLoadImageFromStream GdipSaveImageToStream GdiplusStartup

ncrypt

NCryptCreatePersistedKey NCryptSetProperty NCryptFreeObject BCryptCloseAlgorithmProvider BCryptGenRandom NCryptOpenStorageProvider BCryptOpenAlgorithmProvider NCryptFinalizeKey

kernel32

InitializeSListHead GetStartupInfoW RtlUnwindEx GetFullPathNameW GetStdHandle WriteFile LoadLibraryExA GetModuleFileNameW GetSystemPowerStatus OpenProcess MultiByteToWideChar Sleep GetLastError CloseHandle GetCurrentDirectoryW SetCurrentDirectoryW GetProcAddress SetEnvironmentVariableA CreateProcessW FreeLibrary WideCharToMultiByte GetCurrentThreadId GetModuleHandleA WaitForSingleObjectEx CreateThread QueueUserAPC OpenThread ReadFile LoadLibraryA SleepEx SetSystemPowerState GetCurrentProcess SetThreadExecutionState HeapFree HeapAlloc GetProcessHeap SystemTimeToFileTime EnterCriticalSection FileTimeToSystemTime QueryPerformanceFrequency SystemTimeToTzSpecificLocalTime QueryPerformanceCounter ReleaseSemaphore WaitForSingleObject CreateSemaphoreA CancelIo FindFirstFileW FindNextFileW RemoveDirectoryW GetFinalPathNameByHandleW GetDriveTypeA SetFilePointer FindFirstVolumeA FindClose CreateFileW GetVolumePathNamesForVolumeNameA GetFileAttributesExW ReadDirectoryChangesW FindNextVolumeA FindVolumeClose GetDiskFreeSpaceExA CreateEventA GetModuleHandleExA WaitForMultipleObjectsEx CreateNamedPipeA DisconnectNamedPipe CreateFileA CancelIoEx LocalFree ConnectNamedPipe SetConsoleMode GetConsoleMode SetConsoleOutputCP IsDebuggerPresent TerminateProcess GetTempPathW CancelSynchronousIo SetEvent IsProcessorFeaturePresent GetThreadId GetCurrentProcessId GetEnvironmentStrings FreeEnvironmentStringsA CopyFileW RtlCaptureContext SuspendThread ResumeThread DuplicateHandle GetTickCount64 GetCurrentThread GetOverlappedResult GetThreadContext WTSGetActiveConsoleSessionId GetExitCodeProcess SetEndOfFile DeleteFileW SetFilePointerEx SetConsoleCtrlHandler FreeConsole LoadLibraryExW SetLastError GetFileType GetModuleHandleW SwitchToFiber DeleteFiber CreateFiber GetSystemTimeAsFileTime ConvertFiberToThread ConvertThreadToFiber GetEnvironmentVariableW ReadConsoleA ReadConsoleW LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW CreateDirectoryW GetConsoleCP MoveFileExW SetEnvironmentVariableW GetTimeZoneInformation SetStdHandle GetDriveTypeW PeekNamedPipe GetCommandLineA GetCommandLineW GetACP GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetStringTypeW HeapReAlloc FlushFileBuffers WriteConsoleW GetCPInfo FindFirstFileExW SetUnhandledExceptionFilter RtlLookupFunctionEntry RtlVirtualUnwind ResetEvent UnhandledExceptionFilter IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW RaiseException HeapSize RtlPcToFileHeader GetSystemTime EncodePointer

user32

EndDialog SetWindowTextW GetWindowPlacement ShowWindow GetDlgCtrlID SetWindowPlacement SetWindowTextA IsDlgButtonChecked GetDlgItem CheckDlgButton DialogBoxParamW EnableWindow MessageBeep ExitWindowsEx GetUserObjectInformationA EnumDisplayMonitors GetSystemMetrics SetThreadDesktop GetThreadDesktop CloseDesktop BlockInput GetMonitorInfoA OpenInputDesktop GetKeyState GetMessageA GetMessageExtraInfo DispatchMessageA SendMessageW DestroyWindow GetDC PostMessageA GetIconInfo CallNextHookEx GetCursorInfo SetWindowsHookExA MapVirtualKeyA GetForegroundWindow UnhookWindowsHookEx DefWindowProcA CreateWindowExA TranslateMessage UnregisterClassA DrawIconEx SetWinEventHook RegisterClassExA UnhookWinEvent SetForegroundWindow ReleaseDC SendInput SetProcessDPIAware MessageBoxW GetUserObjectInformationW GetProcessWindowStation GetWindowRect LoadCursorA CreateWindowExW

gdi32

SetTextColor SetBkMode SetBkColor CreateSolidBrush BitBlt StretchBlt DeleteDC SetStretchBltMode GetObjectA CreateCompatibleBitmap SelectObject CreateCompatibleDC GetDIBits DeleteObject GetStockObject

advapi32

CloseServiceHandle AllocateAndInitializeSid CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource StartServiceCtrlDispatcherA RegCreateKeyW RegSetValueExA RegDeleteKeyA RegCloseKey RegOpenKeyExA OpenProcessToken InitiateSystemShutdownA LookupPrivilegeValueA AdjustTokenPrivileges CryptReleaseContext RegSetValueExW CryptDestroyKey InitializeSecurityDescriptor SetEntriesInAclA SetSecurityDescriptorDacl DuplicateTokenEx CreateProcessAsUserW SetTokenInformation OpenServiceA CheckTokenMembership FreeSid RegisterServiceCtrlHandlerExA OpenSCManagerA SetServiceStatus QueryServiceStatus

shell32

ShellExecuteExW

ole32

CoUninitialize CoInitializeEx CreateStreamOnHGlobal

Name

ESeS5as

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

vARwW3E

Size

993KB

Virtual Size

992KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

horgG3G

Size

39KB

Virtual Size

201KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

l8VYvKZ

Size

102KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

t6UcYAl

Size

512B

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

nfohHzL

Size

136KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Yow4w0R

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Ly8f0Sei

Size

1024B

Virtual Size

545B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

nrXIArjY

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

rIFU3nrg

Size

1024B

Virtual Size

588B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

sOgyvLU9

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

7850488aea7f4b6659efae64ba7848aa70a4d0902c9a1cabdf6af881e64966af.bin

comctl32

dbghelp

iphlpapi

ws2_32

crypt32

gdiplus

ncrypt

kernel32

user32

gdi32

advapi32

shell32

ole32

generic