Extracted

• • Target
    meshagent64-Test.exe
  • Size 3.3MB
  • SHA256 99a7abad0f4e79fc9120f2ae250bb716d57e8b130c9f81f403cba0839aeed216
  • MD5 87a2b0957bcc2cf4706213ad94ac0bec
  • SHA1 736df824f4ec1b9b9c996fdbb7ef9cf2b599e41e
  • SHA512 f3a2575641f0f88600909242f00ef7b09c55431c039228de3c68f6d98f8c1ccabda4c63534fd8dcd18fdf12e1d3f5af05cda06396a98faab53d921ef8c7a759f
  • SSDEEP 49152:EMSGj9zai9bsddr7AaPcZumeRQyKpzSPQBcnMFvf8AC4Z78bRwlI5fT:xd9AddBcryO3cICgI9T
  • TLSH
    T162F57CD2A7A600E8E977F23CC9568517E7F2B81713709BCF25A44A660F236D12B3E741
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoortestdiscoveryexecutionmeshagentpersistencerattrojanadwareransomwarespyware

  • Detects MeshAgent payload

  • Family: MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

    rattrojanbackdoormeshagent

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2