MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1bb1c2c4be89e0c88563bb0fccee5e16ff910695bba78c8c43f3259d3f3f8ff0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

MeshAgent

Vendor detections: 14

Intelligence 14 IOCs YARA 2 File information Comments

SHA256 hash:	1bb1c2c4be89e0c88563bb0fccee5e16ff910695bba78c8c43f3259d3f3f8ff0
SHA3-384 hash:	936c7bc06d61206ea926a43225df0771d1c6055b9ea850272dc42de38a1c8534bf84f2b15c75cf0c26e6856c28472cef
SHA1 hash:	a6bc65e26ef3bff3a53b017f1a4273f420f3f2b8
MD5 hash:	f0d3a7e85367282e9f57c7e561a67c3e
humanhash:	princess-east-triple-lemon
File name:	a.bat
Download:	download sample
Signature	MeshAgent Create hunting rule
File size:	228 bytes
First seen:	2026-01-15 17:34:08 UTC
Last seen:	Never
File type:	bat
MIME type:	text/x-msdos-batch
ssdeep	6:hmRLt1U7NKz98XI1R3KujLh8JJwkWgR6Iy5zQQIjHzBW1AQQd7zn:wxGI98XI1kkG3wPIy50QIjHz4AQ0n
Threatray	80 similar samples on MalwareBazaar
TLSH	T15AD02307001D4205CCF3DC40FC53C3A2A343D6C0810A14A366D38C57581239492BFCCA
Magika	batch
Reporter	BlinkzSec
Tags:	193-149-187-81 bat MeshAgent

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

BatchScript

Details

BatchScript

varying reportable information from embedded commands and any observed URLs

Link:

https://research.acce.ciphertechsolutions.com/results/9dc456c8-56fd-44a1-be41-91ebf6181190/

Malware family:

n/a

ID:

File name:

a.bat

Verdict:

Malicious activity

Analysis date:

2026-01-15 17:34:30 UTC

Tags:

loader

Link:

https://app.any.run/tasks/6bd4503c-db57-4109-9c77-3074336e91b0

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/49022/

Detection(s):

SecuriteInfo.com.CMD.Heur.BZC.MNT.Boxter.928.46D7182C.3069.24650.UNOFFICIAL

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6969252757243ef151cd5f60

Tags:

trojan shell agent

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

base64 cmd crypto dropper keylogger lolbin opendir overlay powershell powershell soft-404

Link:

https://www.filescan.io/uploads/69692523584f1963ad551983/reports/9248ce8e-ab8f-43b4-9685-90bd12fafeaa/overview

Verdict:

Malicious

Labled as:

CMD:BZC.MNT.Boxter.928

Link:

https://www.hybrid-analysis.com/sample/1bb1c2c4be89e0c88563bb0fccee5e16ff910695bba78c8c43f3259d3f3f8ff0

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-01-15T14:50:00Z UTC

Last seen:

2026-01-16T13:28:00Z UTC

Hits:

~100

Detections:

Trojan.Win32.Agent.sb Trojan-Downloader.Agent.HTTP.C&C Trojan.Scar.HTTP.C&C HEUR:Trojan.BAT.Agent.gen Backdoor.Agent.HTTP.C&C NetTool.PowerShellUA.HTTP.C&C NetTool.PowerShellGet.HTTP.C&C not-a-virus:HEUR:RemoteAdmin.Win32.MeshAgent.gen

Link:

https://opentip.kaspersky.com/1bb1c2c4be89e0c88563bb0fccee5e16ff910695bba78c8c43f3259d3f3f8ff0/results?tab=lookup

Score:

66%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/1bb1c2c4be89e0c88563bb0fccee5e16ff910695bba78c8c43f3259d3f3f8ff0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1bb1c2c4be89e0c88563bb0fccee5e16ff910695bba78c8c43f3259d3f3f8ff0/

Verdict:

Malicious

Threat:

Trojan.Win32.Agent

Link:

https://tip.neiki.dev/file/1bb1c2c4be89e0c88563bb0fccee5e16ff910695bba78c8c43f3259d3f3f8ff0

Threat name:

Script-PowerShell.Downloader.Boxter

Status:

Malicious

First seen:

2026-01-15 17:32:30 UTC

File Type:

Text (Batch)

AV detection:

5 of 24 (20.83%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=doy4frf6rhqmrbldxmh4z3s6c37zcbuvxotyzdcd6msz2pz7r7ya._file

Verdict:

malicious

Label(s):

meshagent

MeshAgent

94723e64a4fe32436b43aef84d14a0cd912cf3b17c881572c2e9d92e9349adc7

MeshAgent

d530c63416f12df760514d0e7f0acfbabe74e66b4dc923d6d8ce060d62aa7a03

MeshAgent

daa464f738edaa9ac8aec2b174e0dbd1edb7040a380a374a7e62aff90e0bbada

MeshAgent

ed9eaead2f8c731f8ab49ee52bab2057ae526c1029316cb2b20a5f01eb0697c6

MeshAgent

error

MeshAgent

+ 70 additional samples on MalwareBazaar

Result

Malware family:

meshagent

Score:

10/10

Tags:

family:meshagent botnet:lnk backdoor discovery execution persistence rat trojan

Link:

https://tria.ge/reports/260115-v5mjbahs7c/

Behaviour

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Drops file in Program Files directory

Drops file in System32 directory

Checks installed software on the system

Executes dropped EXE

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Sets service image path in registry

Detects MeshAgent payload

MeshAgent

Meshagent family

Malware Config

C2 Extraction:

http://meshcentral.girydsfsggvb.com:443/agent.ashx

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/1bb1c2c4be89/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1bb1c2c4be89e0c88563bb0fccee5e16ff910695bba78c8c43f3259d3f3f8ff0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	WIN_ClickFix_Detection Create hunting rule
Author:	dogsafetyforeverone
Description:	Detects ClickFix social engineering technique using 'Verify you are human' messages and malicious PowerShell commands
Reference:	ClickFix social engineering and malicious PowerShell commands