🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5f636069e9fdffbd31fe0a2327126bd1f3ba0e7f67b58c8c29c8a648d0a65e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


MeshAgent


Vendor detections: 13


Intelligence 13 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b5f636069e9fdffbd31fe0a2327126bd1f3ba0e7f67b58c8c29c8a648d0a65e6
SHA3-384 hash: 988d056453fbfc52c066824a89fe9e86ac9f982076ed5814a6259671dc32ed84a7b9ed0646a47dd49855cff714d28d23
SHA1 hash: 3e2e8723b8384cddaced3dc9179845a4a6336592
MD5 hash: 0f3bcb00f0e2f1ab8b0c59e7af7814ba
humanhash: green-green-low-purple
File name:Sync.bat
Download: download sample
Signature MeshAgent
Create hunting rule
File size:3'791 bytes
First seen:2026-11-15 16:35:27 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/x-msdos-batch
ssdeep 96:pnv7FouLa7dzKdYGY+z9hxatEI+EjMt3lREkOxCjhE6nE5M/8obcB:pnv7Pa7dzJG9hxatE4E5OxQhyg8obcB
TLSH T1A671DC3DDAB1FCC047BD72D0DD263E9720A45B23DBB04A78DA8214AA1C24255DF3B29C
Magika batch
Reporter smackeythefrog
Tags:bat MeshAgent

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Malware configuration found for:
BatchScript
Details
Link:
https://research.acce.ciphertechsolutions.com/results/b046cecc-2e69-46f2-b638-9074a1803e12/
Malware family:
n/a
ID:
1
File name:
Who-Are-You-.bat
Verdict:
Malicious activity
Analysis date:
2026-11-12 04:53:58 UTC
Tags:
susp-powershell neptunerat rat loader
Link:
https://app.any.run/tasks/c2faa27c-d6f3-4d9e-a3b5-fc71a8d85908

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/100149/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af9df7efc945c1ebf2a4d7f
Tags:
shell virus sage
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
base64 cmd evasive lolbin obfuscated ping powershell
Link:
https://www.filescan.io/uploads/6af9df79ea2ef41e548fb2d6/reports/5a4f4e35-c4d4-444e-9a22-ce69c782d6ff/overview
Verdict:
Malicious
Labled as:
PowerShell/TrojanDownloader.Agent
Link:
https://www.hybrid-analysis.com/sample/b5f636069e9fdffbd31fe0a2327126bd1f3ba0e7f67b58c8c29c8a648d0a65e6
Verdict:
Malicious
File Type:
unix shell
Link:
https://opentip.kaspersky.com/b5f636069e9fdffbd31fe0a2327126bd1f3ba0e7f67b58c8c29c8a648d0a65e6/results?tab=lookup
Result
Threat name:
MeshAgent
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/2006428
Signature
AI detected malicious Powershell script
Bypasses PowerShell execution policy
Creates files in the system32 config directory
Drops script or batch files to the startup folder
Encrypted powershell cmdline option found
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Powershell drops PE file
Sigma detected: Drops script at startup location
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded Invoke Keyword
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Encoded PowerShell Command Line
Sigma detected: Suspicious Ping/Del Command Combination
Sigma detected: Suspicious PowerShell Encoded Command Patterns
Sigma detected: Suspicious Script Execution From Temp Folder
Suspicious execution chain found
Suspicious powershell command line found
Uses cmd line tools excessively to alter registry or file data
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected MeshAgent RemoteAdmin Tool
Yara detected Powershell download and execute
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 2006428 Sample: Sync.bat Startdate: 15/11/2026 Architecture: WINDOWS Score: 100 86 deskrelay.net 2->86 104 Found malware configuration 2->104 106 Multi AV Scanner detection for submitted file 2->106 108 Yara detected UAC Bypass using CMSTP 2->108 110 13 other signatures 2->110 9 cmd.exe 1 2->9         started        12 powershell.exe 2->12         started        14 cmd.exe 2->14         started        16 8 other processes 2->16 signatures3 process4 signatures5 116 Suspicious powershell command line found 9->116 118 Uses ping.exe to sleep 9->118 120 Encrypted powershell cmdline option found 9->120 124 2 other signatures 9->124 18 powershell.exe 12 9->18         started        21 conhost.exe 9->21         started        23 powershell.exe 12->23         started        25 cmd.exe 12->25         started        27 curl.exe 12->27         started        30 conhost.exe 12->30         started        32 powershell.exe 14->32         started        34 conhost.exe 14->34         started        122 Creates files in the system32 config directory 16->122 process6 file7 92 Suspicious powershell command line found 18->92 94 Drops script or batch files to the startup folder 18->94 96 Uses schtasks.exe or at.exe to add and modify task schedules 18->96 102 2 other signatures 18->102 36 powershell.exe 21 18->36         started        40 curl.exe 2 18->40         started        43 cmd.exe 1 18->43         started        45 conhost.exe 18->45         started        98 Uses cmd line tools excessively to alter registry or file data 23->98 47 conhost.exe 23->47         started        53 11 other processes 23->53 100 Uses ping.exe to sleep 25->100 55 2 other processes 25->55 84 dr-70981844e6f94219bc7d51b82915624f.ps1, ASCII 27->84 dropped 49 curl.exe 32->49         started        51 conhost.exe 32->51         started        signatures8 process9 dnsIp10 70 C:\Program Files\SyncAgent\SyncAgent.exe, PE32+ 36->70 dropped 72 C:\Users\user\AppData\Roaming\...\Sync.bat, DOS 36->72 dropped 74 sa-f93c3205cca94350bb80c72d98aa7fbe.xml, Unicode 36->74 dropped 76 C:\Program Files\SyncAgent\sync.ps1, ASCII 36->76 dropped 112 Hides that the sample has been downloaded from the Internet (zone.identifier) 36->112 57 curl.exe 36->57         started        60 conhost.exe 36->60         started        62 curl.exe 36->62         started        68 12 other processes 36->68 88 deskrelay.net 216.73.157.157, 443, 49701, 49706 RELIABLESITE-ReliableSiteNetLLCUS Netherlands 40->88 90 127.0.0.1 unknown unknown 40->90 78 dr-2ba20d8c5476483899b3283cf2586293.ps1, ASCII 40->78 dropped 114 Uses ping.exe to sleep 43->114 64 conhost.exe 43->64         started        66 PING.EXE 43->66         started        80 dr-69165dc17ad14492ab6343cc4b9b28d2.ps1, ASCII 49->80 dropped file11 signatures12 process13 file14 82 dr-87dc0c0d0be04c4f86b31eaa33e9dc4f.tmp, PE32+ 57->82 dropped
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/b5f636069e9fdffbd31fe0a2327126bd1f3ba0e7f67b58c8c29c8a648d0a65e6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b5f636069e9fdffbd31fe0a2327126bd1f3ba0e7f67b58c8c29c8a648d0a65e6/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wx3dmbu6t7p7xuy74crde4jgxuptxihh6z5vrsgctsfgjdikmxta._file
Result
Malware family:
meshagent
Create hunting rule
Score:
  10/10
Tags:
family:meshagent botnet:support backdoor defense_evasion discovery execution persistence privilege_escalation rat trojan
Link:
https://tria.ge/reports/261115-t39qdsxz9k/
Behaviour
Modifies data under HKEY_USERS
Runs ping.exe
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Views/modifies file attributes
cURL User-Agent
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
System Network Configuration Discovery: Internet Connection Discovery
Drops file in Program Files directory
Drops file in Windows directory
Launches sc.exe
Drops file in System32 directory
Creates a file in the Startup directory
Executes dropped EXE
Modifies file permissions
Command and Scripting Interpreter: PowerShell
Downloads MZ/PE file
Detects MeshAgent payload
Family: MeshAgent
Malware Config
C2 Extraction:
http://deskrelay.net:443/agent.ashx
Dropper Extraction:
https://deskrelay.net/downloads
https://deskrelay.net/downloads/install.ps1
https://relay.deskrelay.net/downloads/install.ps1
https://deskrelay.net
https://relay.deskrelay.net/dl/agent
Malware Family:
alien
Create hunting rule
Malicious:
True
Tags:
persistence wmi-activity self-delete bat obfuscated debug-check macro-ps
Link:
https://intel.virussign.com/intelligence/file/b5f636069e9fdffbd31fe0a2327126bd1f3ba0e7f67b58c8c29c8a648d0a65e6
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:PowerShell_Susp_Parameter_Combo_RID336F
Create hunting rule
Author:Florian Roth
Description:Detects PowerShell invocation with suspicious parameters
Reference:https://goo.gl/uAic1X
Rule name:SCRIPT_Dropper_Unknown_ForgeAuto_aaa464f7
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (script_js, etat binaire)
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/100149/

Comments