MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 daa464f738edaa9ac8aec2b174e0dbd1edb7040a380a374a7e62aff90e0bbada. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
MeshAgent
Vendor detections: 13
| SHA256 hash: | daa464f738edaa9ac8aec2b174e0dbd1edb7040a380a374a7e62aff90e0bbada |
|---|---|
| SHA3-384 hash: | 29ce68a2b83ccbb8dd3d290020d6024e9617e4bb429777098b1e7560f378788853f161b0666581f5b4ad8fe9c7917694 |
| SHA1 hash: | a0cd7e8628bdeff3bfd512677439e02943646211 |
| MD5 hash: | f6d0209859396816de679f18ba8c1cbe |
| humanhash: | arizona-minnesota-bulldog-dakota |
| File name: | google drive.exe |
| Download: | download sample |
| Signature | MeshAgent |
| File size: | 1'629'184 bytes |
| First seen: | 2025-11-29 10:43:11 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 1b30fa183bfe9ff390e568cb23d331e5 (1 x MeshAgent) |
| ssdeep | 24576:2IrWeyV+E6YHxQtJhdp1PWUWA3rqAQQoGDnNMotEHXcoS1iW1WW4Vw8q:cZVnREdp1OE3q2njtEi1i0mq |
| Threatray | 70 similar samples on MalwareBazaar |
| TLSH | T1727500252484EABFD820043CFC3645B66F69AF1B651DEAC79DB93D5234BE6C3B0110B9 |
| TrID | 32.2% (.EXE) Win16 NE executable (generic) (5038/12/1) 28.8% (.EXE) Win32 Executable (generic) (4504/4/1) 13.0% (.EXE) OS/2 Executable (generic) (2029/13) 12.8% (.EXE) Generic Win/DOS Executable (2002/3) 12.8% (.EXE) DOS Executable Generic (2000/1) |
| Magika | pebin |
| Reporter |  juroots |
| Tags: | exe MeshAgent |
Intelligence
File Origin
# of uploads :
1
# of downloads :
83
Origin country :
CHVendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
_daa464f738edaa9ac8aec2b174e0dbd1edb7040a380a374a7e62aff90e0bbada.exe
Verdict:
Malicious activity
Analysis date:
2025-11-29 10:48:43 UTC
Tags:
meshagent rmm-tool
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Verdict:
Malicious
Score:
99.9%
Tags:
agent shell sage
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Modifying an executable file
Searching for synchronization primitives
Running batch commands
Creating a process with a hidden window
Launching a process
Restart of the analyzed sample
Creating a file
Using the Windows Management Instrumentation requests
Creating a file in the Program Files subdirectories
Creating a service
Launching a service
Creating a file in the system32 subdirectories
Connection attempt
Creating a window
Sending a custom TCP request
Enabling autorun for a service
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Result
Gathering data
Verdict:
Adware
File Type:
exe x32
First seen:
2025-11-27T06:43:00Z UTC
Last seen:
2025-11-27T06:59:00Z UTC
Hits:
~10
Verdict:
Malicious
Score:
98%
Verdict:
Malware
File Type:
PE
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Verdict:
Malicious
Threat:
Family.MESHAGENT
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
meshagent
Similar samples:
+ 60 additional samples on MalwareBazaar
Result
Malware family:
meshagent
Score:
10/10
Tags:
family:meshagent botnet:support backdoor discovery execution persistence rat trojan upx
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Command and Scripting Interpreter: PowerShell
Drops file in System32 directory
UPX packed file
Checks installed software on the system
Checks computer location settings
Executes dropped EXE
Sets service image path in registry
Detects MeshAgent payload
MeshAgent
Meshagent family
Malware Config
C2 Extraction:
http://45.93.95.199:444/agent.ashx
Unpacked files
SH256 hash:
daa464f738edaa9ac8aec2b174e0dbd1edb7040a380a374a7e62aff90e0bbada
MD5 hash:
f6d0209859396816de679f18ba8c1cbe
SHA1 hash:
a0cd7e8628bdeff3bfd512677439e02943646211
SH256 hash:
92b15e516cd38bdefdd43bb8af5dffae758a0c2b9b19ed983ae6c0a648fd12ba
MD5 hash:
25fb6dab39610ba2283b58b523a4e2dd
SHA1 hash:
df7679532d32cb588c76a8b183a093046e23ee2f
Detections:
INDICATOR_RMM_MeshAgent
SH256 hash:
9fd2629452b6272967c9816999eec64ad72571905fc76c723dc961fec5eeecea
MD5 hash:
9ecdff0b4883caf16c9bca372535cf08
SHA1 hash:
80e7a5fbed70a372493b402560e5dcfe86bf0e98
Detections:
INDICATOR_RMM_MeshAgent
SH256 hash:
4ad8e4e3181e8884da13b8729c6f9e05865b4b85f80ccae6be41a58f060ce44f
MD5 hash:
8cfa7caeb6f14c1865b718b6f9a98d9d
SHA1 hash:
edd6e3f59e55066171155be6536d237a8f77d051
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | FreddyBearDropper |
|---|---|
| Author: | Dwarozh Hoshiar |
| Description: | Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip. |
| Rule name: | UPX293300LZMAMarkusOberhumerLaszloMolnarJohnReiser |
|---|---|
| Author: | malware-lu |
| Rule name: | UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser |
|---|---|
| Author: | malware-lu |
| Rule name: | UPXv20MarkusLaszloReiser |
|---|---|
| Author: | malware-lu |
| Rule name: | upx_largefile |
|---|---|
| Author: | k3nr9 |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.