meshagent | 2026-06-27_9e2ac4b603ca681b20cc44894c51afe9_coinminer_glassworm_icedid_njrat_ryuk_sliver

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-27_9e2ac4b603ca681b20cc44894c51afe9_coinminer_glassworm_icedid_njrat_ryuk_sliver
Size 3.1MB
Sample260629-e7t36sds2t
SHA256 461f2b38f626d666c05636084e430e09fc417dd14895937cde7f554462907135
MD5 9e2ac4b603ca681b20cc44894c51afe9
SHA1 4a58af5f74f4cd091c4f0ea0d8b77b620e7dffca
SHA512 7c4b19862a3e760c9a941732ce8bacc603ef63d7ee01b4e1c84dc05155864e6f3f69c1e0518db89a28c637f84fd374b23ab7a88c56d679edf2ba25c9ced4d518
SSDEEP 49152:JdiQ2Wa7SPWaqMrr1Au27fTfCRklplGeuNr+s9y7XNMFvfo1Up65Y5Ru452m:DASeabCfdvu/kX3UVQm
TLSH
T154E58DC2A7AA00E8E977F23889468517E7F2B817137097DB25A44A7A0F137D11B3F746
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

teleassistenza rat trojan backdoor meshagent

Malware Config

Extracted

Family

meshagent

Version

Botnet

Teleassistenza

http://meshcentral.seit.it:443/agent.ashx

Attributes

mesh_id
0x3EC13BE67C241E9EADE3D478E5780B7ADAFB4C107D8B680992E558564057465F2A61BB07B2051C12B0D821CC0FE939D4
server_id
457EC4327B0A0AEFFE515AED436E7FC7EC8CFCDEDE3DD734FCBFA6B0F6C41172D0CC23B8D4383EA373938AFF5ACD7997
wss
wss://meshcentral.seit.it:443/agent.ashx

Signatures

Family: MeshAgent
MeshAgent is an open source remote access trojan written in C++.
rat trojan backdoor meshagent

Detects MeshAgent payload 1 IoCs

resource	yara_rule
sample	family_meshagent

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-27_9e2ac4b603ca681b20cc44894c51afe9_coinminer_glassworm_icedid_njrat_ryuk_sliver

File Explorer

2026-06-27_9e2ac4b603ca681b20cc44894c51afe9_coinminer_glassworm_icedid_njrat_ryuk_sliver

.exe 3.1MB

2026-06-27_9e2ac4b603ca681b20cc44894c51afe9_coinminer_glassworm_icedid_njrat_ryuk_sliver

IMPHASH 4cc3bdc134cf6bcfde6806c44bed4ac7
SHA256 461f2b38f626d666c05636084e430e09fc417dd14895937cde7f554462907135
MD5 9e2ac4b603ca681b20cc44894c51afe9
SHA1 4a58af5f74f4cd091c4f0ea0d8b77b620e7dffca
SHA512 7c4b19862a3e760c9a941732ce8bacc603ef63d7ee01b4e1c84dc05155864e6f3f69c1e0518db89a28c637f84fd374b23ab7a88c56d679edf2ba25c9ced4d518
SSDEEP 49152:JdiQ2Wa7SPWaqMrr1Au27fTfCRklplGeuNr+s9y7XNMFvfo1Up65Y5Ru452m:DASeabCfdvu/kX3UVQm
TLSH
T154E58DC2A7AA00E8E977F23889468517E7F2B817137097DB25A44A7A0F137D11B3F746
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects MeshAgent payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1884332

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\MeshAgent\MeshAgent\Release\MeshService64.pdb

dbghelp

MiniDumpWriteDump SymFromAddr StackWalk64 SymInitialize SymFunctionTableAccess64 SymGetLineFromAddr64 SymGetModuleBase64

iphlpapi

GetAdaptersAddresses SendARP ConvertLengthToIpv4Mask GetAdaptersInfo

ws2_32

ntohl WSAGetLastError ioctlsocket recv gethostname htonl htons ntohs WSASetLastError send getsockname WSASocketW listen closesocket bind accept __WSAFDIsSet setsockopt socket sendto getsockopt recvfrom connect shutdown WSAIoctl GetAddrInfoW WSAResetEvent WSAEventSelect WSAStartup WSACreateEvent WSACloseEvent select WSACleanup FreeAddrInfoW

crypt32

CertEnumCertificatesInStore CertDeleteCertificateFromStore CryptAcquireCertificatePrivateKey CertAddEncodedCertificateToStore CryptMsgClose CryptMsgUpdate CryptExportPublicKeyInfo CertCreateSelfSignCertificate CertFreeCertificateContext CryptMsgOpenToEncode CertAddCertificateContextToStore PFXExportCertStore CryptSignAndEncodeCertificate CertCloseStore CertStrToNameA CryptMsgGetParam CryptEncodeObject CertSetCertificateContextProperty CertFindCertificateInStore CryptMsgCalculateEncodedLength CertOpenStore CertStrToNameW CertDuplicateCertificateContext CertGetCertificateContextProperty

gdiplus

GdipGetImageEncoders GdipCloneImage GdiplusStartup GdipAlloc GdipDisposeImage GdipFree GdipGetImageEncodersSize GdipSaveImageToStream GdiplusShutdown GdipLoadImageFromStream

ncrypt

NCryptCreatePersistedKey NCryptFreeObject NCryptFinalizeKey BCryptOpenAlgorithmProvider NCryptOpenStorageProvider BCryptGenRandom NCryptSetProperty BCryptCloseAlgorithmProvider

kernel32

InitializeSListHead GetStartupInfoW RtlUnwindEx GetFullPathNameW GetStdHandle WriteFile LoadLibraryExA GetModuleFileNameW GetSystemPowerStatus OpenProcess MultiByteToWideChar Sleep GetLastError CloseHandle GetCurrentDirectoryW SetCurrentDirectoryW GetProcAddress SetEnvironmentVariableA CreateProcessW FreeLibrary WideCharToMultiByte WaitForSingleObject GetCurrentThreadId GetModuleHandleA CreateThread QueueUserAPC OpenThread ReadFile LoadLibraryA SleepEx SetSystemPowerState GetCurrentProcess SetThreadExecutionState HeapFree HeapAlloc GetProcessHeap SystemTimeToFileTime GetSystemTime FileTimeToSystemTime QueryPerformanceFrequency QueryPerformanceCounter ReleaseSemaphore CreateSemaphoreA CancelIo FindFirstFileW FindNextFileW RemoveDirectoryW GetFinalPathNameByHandleW GetDriveTypeA SetFilePointer FindFirstVolumeA FindClose CreateFileW GetVolumePathNamesForVolumeNameA GetFileAttributesExW ReadDirectoryChangesW FindNextVolumeA FindVolumeClose GetDiskFreeSpaceExA CreateEventA GetModuleHandleExA WaitForMultipleObjectsEx CreateNamedPipeA DisconnectNamedPipe CreateFileA CancelIoEx LocalFree ConnectNamedPipe SetConsoleOutputCP IsDebuggerPresent TerminateProcess GetTempPathW CancelSynchronousIo SetEvent WaitForSingleObjectEx ResetEvent GetThreadId GetCurrentProcessId IsProcessorFeaturePresent FreeEnvironmentStringsA CopyFileW RtlCaptureContext SuspendThread ResumeThread DuplicateHandle GetTickCount64 GetCurrentThread GetOverlappedResult GetThreadContext WTSGetActiveConsoleSessionId GetExitCodeProcess SetEndOfFile DeleteFileW SetFilePointerEx SetConsoleCtrlHandler FreeConsole LoadLibraryExW SetLastError GetFileType GetModuleHandleW SwitchToFiber DeleteFiber EncodePointer GetSystemTimeAsFileTime ConvertFiberToThread ConvertThreadToFiber GetEnvironmentVariableW GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW CreateDirectoryW GetConsoleCP MoveFileExW SetEnvironmentVariableW GetTimeZoneInformation SetStdHandle GetDriveTypeW PeekNamedPipe GetCommandLineA GetCommandLineW GetACP GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetStringTypeW HeapReAlloc FlushFileBuffers WriteConsoleW GetCPInfo FindFirstFileExW SetUnhandledExceptionFilter RtlLookupFunctionEntry RtlVirtualUnwind GetEnvironmentStrings UnhandledExceptionFilter IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW RaiseException HeapSize RtlPcToFileHeader SystemTimeToTzSpecificLocalTime CreateFiber

user32

EndDialog SetWindowTextW GetWindowPlacement ShowWindow SetWindowPlacement SetWindowTextA GetDlgItem DialogBoxParamW EnableWindow MessageBeep ExitWindowsEx GetUserObjectInformationA EnumDisplayMonitors GetSystemMetrics SetThreadDesktop GetThreadDesktop CloseDesktop BlockInput GetMonitorInfoA OpenInputDesktop GetMessageA SendMessageW DispatchMessageA LoadCursorA DestroyWindow GetDC PostMessageA GetIconInfo GetCursorInfo MapVirtualKeyA GetForegroundWindow DefWindowProcA CreateWindowExA TranslateMessage UnregisterClassA DrawIconEx SetWinEventHook RegisterClassExA UnhookWinEvent SetForegroundWindow ReleaseDC SendInput SetProcessDPIAware GetWindowRect GetProcessWindowStation GetUserObjectInformationW MessageBoxW GetMessageExtraInfo

gdi32

GetStockObject SetTextColor SetBkMode CreateSolidBrush BitBlt GetObjectA DeleteObject DeleteDC GetDIBits CreateCompatibleDC SelectObject CreateCompatibleBitmap SetStretchBltMode StretchBlt

advapi32

QueryServiceStatus RegisterEventSourceW DeregisterEventSource CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptAcquireContextW RegDeleteValueA RegCreateKeyW RegOpenKeyExA RegSetValueExA RegQueryValueExA RegDeleteKeyA RegCloseKey OpenProcessToken InitiateSystemShutdownA LookupPrivilegeValueA AdjustTokenPrivileges CryptReleaseContext RegSetValueExW CryptDestroyKey InitializeSecurityDescriptor SetEntriesInAclA SetSecurityDescriptorDacl DuplicateTokenEx CreateProcessAsUserW SetTokenInformation OpenServiceA CheckTokenMembership FreeSid RegisterServiceCtrlHandlerExA OpenSCManagerA SetServiceStatus AllocateAndInitializeSid CloseServiceHandle StartServiceCtrlDispatcherA ReportEventW

shell32

ShellExecuteExW

ole32

CoUninitialize CoInitializeEx CoCreateInstance CreateStreamOnHGlobal

oleaut32

SysFreeString SysStringLen SysAllocString

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

880KB

Virtual Size

880KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

34KB

Virtual Size

194KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

101KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

136KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2026-06-27_9e2ac4b603ca681b20cc44894c51afe9_coinminer_glassworm_icedid_njrat_ryuk_sliver

dbghelp

iphlpapi

ws2_32

crypt32

gdiplus

ncrypt

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

generic