meshagent | b3d5a1cc7eae4730a736b333b8a5b9092be7063bafbb637bc9977c6efd3e5312

Sharing

Copy URL Twitter E-mail

General

Target
Installer.41-54-8-27.zip
Size 7.2MB
Sample260914-te6c3abe82
SHA256 b3d5a1cc7eae4730a736b333b8a5b9092be7063bafbb637bc9977c6efd3e5312
MD5 4c67e21baee732cd8a98d35f3d5b4a0c
SHA1 68533bf2160f132978fadaed049d9cb09571d913
SHA512 d5b4e245b418de66e2a33d1a0e37de291dad886ebad82801e83d3f1d3e779baf7cca6b9304d5e6b1ed3a381e564aaa325f710d7b396b583c52ba71bdc9c66f96
SSDEEP 196608:cu11MftV2BNhzY01mQn1uJhAYBUxSVHjLkoM2HcaXhF:x1vThznL1urBB8on2EcaXb
TLSH
T1DF7633C0CCBB1793AF5CD409E3B22A2A7F620D1916475D2D616E76362FE32E481276DC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

meshagent

Version

Botnet

http://player.gamesstatusfun.com:443/agent.ashx

Attributes

mesh_id
0xAE428A5A0906258DF1CE1DCB7103054BBBEA79CE744530C32868BD180AFD486D1FBE469A58ECB0917D6F60DB624EC18A
server_id
4E185E1B5FBF52FC1CF1F625EACF0197475E2E5F40A3305F53A7B6CE9C5D86863C8D78CE2B08939BD77FDDECC969D5D9
wss
wss://player.gamesstatusfun.com:443/agent.ashx

Targets

- Target
  App/alpha59621/Installer-35-12-5-64.dll
- Size 1KB
- SHA256 2e910a79aff718549abd123aa54f9222775d09712de7d1025821745718bb53d8
- MD5 3434aee1893bd9757660df3c681cba2e
- SHA1 0ac577ff578a41eff563ee80545e758b273d6ef3
- SHA512 a749535362b1ca0739b84eeca4a1805e4233a32b18c106bf32528d5702dc2f2b59ad29a556d6ee99761fb57038bf65f064f5ef212a931da7c0173133f3b1c867
- TLSH
  T1AF21532C19F945A665B37671984F901B29DFC050420AEB04B1DC8F88AFC4860C10779F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  App/alpha59621/Installer-35-12-5-64.exe
- Size 17.6MB
- SHA256 c1c84e86807e1a0f0594fae6883f904c958710e8dbeb760249fcc59eec9e9949
- MD5 58b991179f8d4da130a15fbf7c6a5dbe
- SHA1 bfd37182cd581be0f605fea0e15d5fd39fd3d1be
- SHA512 46bbdb276f0fca102748a9f3e524f2588190c26986622a9caea82d444ad7e9bd7da953d40269346e46b561ccf35c577fccfc4a57930f7c47047939bfbedb97ac
- SSDEEP 393216:ouwsDosgM/q+Yv5Yr+ecWxkN0StzZX1zVmEAI9:TDosgM/q+Yv5Yr+ecY6zZlvAI9
- TLSH
  T14D079D13B6D301E1E9A3567004FB622B5637AA12873089CBF25C3A546F732D17B377A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Installer.35-12-5-64.exe
- Size 152KB
- SHA256 9d9dd44c508af2fe864a8264ba5833d7c47fd21fe1b4c72ff6e05f7da94c288f
- MD5 ddc559ab995e489f7ad9c37d3203f0cf
- SHA1 9d32f3248bef553b666e6b3c7e382ab151a16837
- SHA512 4284ee6ba3621a8d90e52ab41fe4f06d10be62a078d87394af24ba3f3b531575b3d897a4676268576924b9d69991f234cc1c98fd94b18df3010a1e1786f2e285
- SSDEEP 3072:HfweqOYEUXPn4tvFGRfIyZR2di/YB+KYzK3pCW6WG:oEUXWvF2fJZR6K+16K3e
- TLSH
  T14CE3D04097F4C072F9F21EB429B19A621EB6FC010875D55FA308DEDE7931AD09D2AB1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor new discovery execution meshagent persistence rat trojan
- Detects MeshAgent payload
- Family: MeshAgent
  MeshAgent is an open source remote access trojan written in C++.
  rat trojan backdoor meshagent
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral5 behavioral6
- Target
  $PLUGINSDIR/MoreInfo.dll
- Size 7KB
- SHA256 227a4fc9408a44faa5eca608a974bd536814f97b8a4d28b4cac479727167b026
- MD5 bd393029cc49b415b6c9aeb8a4936516
- SHA1 c67fd92fffd18941bed41bfd6ac4f3b04fd123df
- SHA512 3bb8e5cf4bea7e8adaa62196e58fff9031f49fd4efa78e5bd3e4b9c4e9ba1523864567521793053595d90abec719761a5964ff3abe04b93b24d52e5ffa4c1f96
- SSDEEP 96:LEjAlUFPxXJugoImuaKbkBSEPTpsxKaVQ4Ad:gjAiFPxXJugoImJKQk8yxKaVVe
- TLSH
  T1EEE1603263F441EDF9DB0B346C334B291D75BC21EA21957F2691098D3DB1A44EE227B6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
- MD5 bf712f32249029466fa86756f5546950
- SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
- SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
- SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
- TLSH
  T1DC3229328B60C1F2D561C274496B3A3367B9761420B04D67DFB78446EC16AD66E3E327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  $PLUGINSDIR/UAC.dll
- Size 13KB
- SHA256 c5ab2926c268257122d0342739e73573d7eeda34c861bc7a68a02cbc69bd41af
- MD5 a88baad3461d2e9928a15753b1d93fd7
- SHA1 bb826e35264968bbc3b981d8430ac55df1e6d4a6
- SHA512 5edcf46680716930da7fd1a41b8b0426f057cf4becefb3ee84798ec8b449726afb822fb626c4942036a1ae3bb937184d1f71d0e45075abb5bf167f5d833df43a
- SSDEEP 192:qP6KdXy+Yo7e1J8qC25a5mDFmCLGUCVGpU6uNck87I0S/TDqwyTq+:q/q3Pgd5mx6VkEck87ILCTN
- TLSH
  T1CC526C5421D84BBFD24156383ADB776346B9FB316C62818FC6A349CB6871693A93E302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/execDos.dll
- Size 5KB
- SHA256 720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f
- MD5 0deb397ca1e716bb7b15e1754e52b2ac
- SHA1 fbb9bcf872c5dbb4ca4c80fb21d41519bc273ef5
- SHA512 507db0bee0897660750007e7ce674406acf9e8bf942cf26ded5654c07682757b07c9eb767bead0966478abc554dc9a6461c4288dc35d12cacfadad4c128f1bb7
- SSDEEP 96:J++xDiP4p7t7dNOt3stxtRFFXxGD6qxlnKE6ttdH3r3:Rx9pJ7jQs5toD6Cln/6tt1
- TLSH
  T153C1E73AF2E409B3C2A806343EA6A42B17F9D02B071409B7876321CC6CD0DB8FE74256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/newadvsplash.dll
- Size 8KB
- SHA256 0a70cc4b93d87ecd93e538cfbed7c9a4b8b5c6f1042c6069757bda0d1279ed06
- MD5 55a723e125afbc9b3a41d46f41749068
- SHA1 01618b26fec6b8c6bdb866e6e4d0f7a0529fe97c
- SHA512 559157fa1b3eb6ae1f9c0f2c71ccc692a0a0affb1d6498a8b8db1436d236fd91891897ac620ed5a588beba2efa43ef064211a7fcadb5c3a3c5e2be1d23ef9d4c
- SSDEEP 96:/VV0Rwtvrm2nQujIvP9dir3UniV/zRzVR3rN3k8Jd18tsPcaqhx:/VV0KtC2yH9d83BzVR53kEQFaq
- TLSH
  T17702C73972C169F3D26B05F82D526B2E0FEEA035135650228B33A4DA3DA0353FD26747
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/newtextreplace.dll
- Size 11KB
- SHA256 156b9b583399faf13c4d46b89339fb0f7f38dc847ac2d7872178d8e3998b9734
- MD5 b5358341df2cb171876a5f201e31a834
- SHA1 df34750ea5504274be5ff8ddd306b49e302d04f9
- SHA512 821dc42e24fa2d44a1d4d16b26c3da2688dac0fa44a266e38da2aff706c91440d83a87abc74131930e6c38a44a0c5e627db2d045375fde147e0edd3276f4b014
- SSDEEP 192:GGhRfigbU26niqo9m+9k15AA1NrW0QfaDx3nxNLr6s+:GIwgSnhv/IaDx3n6X
- TLSH
  T11832965F729645F6EA2259B00FCFF67B8E90C005402B4F6CB79A896CB933E84710D195
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
- MD5 132e6153717a7f9710dcea4536f364cd
- SHA1 e39bc82c7602e6dd0797115c2bd12e872a5fb2ab
- SHA512 9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1
- SSDEEP 96:M/SspqrIYxLPEQhThvov3TE4/2Sa5P9QFFYzOx4uF3sbSEI5LP39sQvM:M/QUG7lhvov36S5FcUjliSEI5LuQ
- TLSH
  T1A4C1E5B656D909F3E41D00B83E31241F43FEE5260B7A03719E8B2AC61CD2AB6FD58791
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  $PLUGINSDIR/registry.dll
- Size 29KB
- SHA256 acb79c55b3b9c460d032a6f3aaf6c642bf8c1d450e23279d091cc0c6ca510973
- MD5 2880bf3bbbc8dcaeb4367df8a30f01a8
- SHA1 cb5c65eae4ae923514a67c95ada2d33b0c3f2118
- SHA512 ca978702ce7aa04f8d9781a819a57974f9627e969138e23e81e0792ff8356037c300bb27a37a9b5c756220a7788a583c8e40cc23125bcbe48849561b159c4fa3
- SSDEEP 768:HsKZwhFkGOr0Ga4+8DFFHR4mmw5+64fuKwX13:HLKmGOr0Ga4+8DFFHRrmw5+m
- TLSH
  T117D20980D64091A5E4F678FEB7D2633B462D6BB00553A09713F33E57AD68704BB2392E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22