meshagent | 470b563ea0fc75bbaf62c2aa1bd82cf99a0b47a596aaa33a469401eb0896b72b

Sharing

Copy URL Twitter E-mail

General

Target
470b563ea0fc75bbaf62c2aa1bd82cf99a0b47a596aaa33a469401eb0896b72b
Size 3.7MB
Sample260930-tpc49szdmf
SHA256 470b563ea0fc75bbaf62c2aa1bd82cf99a0b47a596aaa33a469401eb0896b72b
MD5 4d4a29e98280a7d4bfb6fdc721c43b66
SHA1 8159b97489adad21c6a19ba815b6a571ec6f313b
SHA512 feba7a04ced1d3d5baf7449e5b46d85cb35632b85645c6bb48dbb9accb2d48f39c56d2e5a9b03f8b317a486c099a8910ab9068bc87d266c79cf7c3c332650abe
SSDEEP 49152:FhzfEV3ugKeuWoAkf6bRexQlNIdwB0pJCWJ0+1NaZPwqe5MZPa:F1fEYnnfKthWq+17KZPa
TLSH
T14406AEC2BB834571F8A736B411AB53BE5D7D69130328D4C3D3D429A989316D0AE3B39B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

sentinel connections rat trojan backdoor meshagent

Malware Config

Extracted

Family

meshagent

Version

Botnet

Sentinel Connections

http://meshserver.net:443/agent.ashx

Attributes

mesh_id
0x8CD5A26AEEC0CAE34887959E8BB7B59405EAAFA59D881B900A107C7E15E4903CA2938A5C3F0376B3970E6098DBEEED2A
server_id
17FE2257E50AE3385ACEC631087405613193F8D5C915B47F123D049FB525022969CA4D12B37B50C77B3D3D4BF886BC66
wss
wss://meshserver.net:443/agent.ashx

Signatures

Family: MeshAgent
MeshAgent is an open source remote access trojan written in C++.
rat trojan backdoor meshagent

Detects MeshAgent payload 1 IoCs

resource	yara_rule
sample	family_meshagent

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
470b563ea0fc75bbaf62c2aa1bd82cf99a0b47a596aaa33a469401eb0896b72b

File Explorer

470b563ea0fc75bbaf62c2aa1bd82cf99a0b47a596aaa33a469401eb0896b72b

.exe 3.7MB

470b563ea0fc75bbaf62c2aa1bd82cf99a0b47a596aaa33a469401eb0896b72b

IMPHASH 51ecb2c9e42bac7962e4489bde292198
SHA256 470b563ea0fc75bbaf62c2aa1bd82cf99a0b47a596aaa33a469401eb0896b72b
MD5 4d4a29e98280a7d4bfb6fdc721c43b66
SHA1 8159b97489adad21c6a19ba815b6a571ec6f313b
SHA512 feba7a04ced1d3d5baf7449e5b46d85cb35632b85645c6bb48dbb9accb2d48f39c56d2e5a9b03f8b317a486c099a8910ab9068bc87d266c79cf7c3c332650abe
SSDEEP 49152:FhzfEV3ugKeuWoAkf6bRexQlNIdwB0pJCWJ0+1NaZPwqe5MZPa:F1fEYnnfKthWq+17KZPa
TLSH
T14406AEC2BB834571F8A736B411AB53BE5D7D69130328D4C3D3D429A989316D0AE3B39B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Detects MeshAgent payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5120

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

ChangeServiceConfig2W CloseServiceHandle CreateServiceW DeleteService OpenSCManagerW OpenServiceW RegisterServiceCtrlHandlerW SetServiceStatus StartServiceCtrlDispatcherW StartServiceW

dnsapi

DnsQuery_W

kernel32

CloseHandle CopyFileW CreateEventW CreateFileW CreateMutexW CreateThread DeleteCriticalSection DeleteFileW EnterCriticalSection FreeConsole GetComputerNameExW GetDriveTypeW GetEnvironmentVariableW GetFileAttributesExW GetFileAttributesW GetLastError GetModuleFileNameW GetModuleHandleA GetProcAddress GetProcessHeap HeapAlloc HeapFree InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection MultiByteToWideChar ReadFile SetEndOfFile SetEvent SetFileAttributesW SetFilePointer SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WriteFile

msvcrt

__p___mb_cur_max __p___winitenv __p__commode __p__iob __p__fmode __set_app_type __setusermatherr __wgetmainargs _amsg_exit _cexit _errno _exit _initterm _lock _unlock _vsnprintf _vsnwprintf abort atexit atoi calloc exit fgetwc fprintf fputwc free fwprintf getc localeconv malloc memcmp memcpy memset setlocale signal strchr strerror strlen strncmp vfprintf wcslen

ntdll

RtlVerifyVersionInfo VerSetConditionMask

ole32

CoCreateGuid CoInitializeEx CoUninitialize

shell32

SHCreateDirectoryExW SHFileOperationW

shlwapi

StrCmpIW

ws2_32

ntohl

Name

.text

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

487B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

470b563ea0fc75bbaf62c2aa1bd82cf99a0b47a596aaa33a469401eb0896b72b

advapi32

dnsapi

kernel32

msvcrt

ntdll

ole32

shell32

shlwapi

ws2_32

generic