Extracted

Extracted

• • Target
    c81b0dbc32f3bc8a57509b6f3ff0c029e4278f0a8f09238fed585f32b4159c11.bin
  • Size 1KB
  • SHA256 c81b0dbc32f3bc8a57509b6f3ff0c029e4278f0a8f09238fed585f32b4159c11
  • MD5 5a94e4bcbcae347cb20c6d170b522bbb
  • SHA1 d97fbf9b8d8a968e8623c9854a6e72d37099aaa2
  • SHA512 42ad90d82c0ba62ab0b77abf72160b87eb675104cebebbad27ac5e419937559d5082fc9067463aa947652c745b3f994074ff0ce6304000af46337000a1026eb2
  • TLSH
    T1143161302A2A35B632B4CAB35287F820597819B9BDD47FB57190E75E9830CD0D1DA5F4
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  backdoormydevicesdefense_evasiondiscoveryexecutionmeshagentpersistencerattrojan

  • Detects MeshAgent payload

  • Family: MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

    rattrojanbackdoormeshagent

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Downloads MZ/PE file

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Stops running service(s)

    defense_evasionexecution

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2