meshagent | 2026-06-30_1691a8fa4fe2e385179017c844425cc9_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_sliver_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-30_1691a8fa4fe2e385179017c844425cc9_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_sliver_stealc
Size 5.5MB
Sample260701-avarjsbv2l
SHA256 372497b5730f77b313b41ca9f063c80f96a540c87b71381a1144e29979825e22
MD5 1691a8fa4fe2e385179017c844425cc9
SHA1 30ed245112a687e2cc773e8c31cd15ab0b67a77a
SHA512 802aa31b7f2916c2e8a449107eca985a52ced6317799dc0b2dda75b4752f54ea3c069890868e69bd2b09a13caebbe5579fddbe4eb3c80468f645836e591881a0
SSDEEP 49152:ROscD438gpfBVmwc/VXYC8nuyHnJV9bDpXxi5QbQqMaWvcqZGC5Wno/t2dJ0Ft26:Dck7YdKbDMmbQgCYoUjLNoUQ
TLSH
T1FA466D83FAAA40F4D47BE13855A26127F975B41203349BDBD2546A6F0F32FD0AA3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

vue4exam rat trojan backdoor meshagent

Malware Config

Extracted

Family

meshagent

Version

Botnet

Vue4exam

http://bullsseo.com:443/agent.ashx

Attributes

mesh_id
0x0F3ECD613895027914E3966633942BEFC309979D4F5197D5707EBE487BFC128081A105E934C70F0FDD6B78A50045F097
server_id
460435B76E2BA7A386C796547EE9B205E12F241B5E68453D37FB6DC55D7215361C5860C69962327ED15D48ACFF0C8280
wss
wss://bullsseo.com:443/agent.ashx

Signatures

Family: MeshAgent
MeshAgent is an open source remote access trojan written in C++.
rat trojan backdoor meshagent

Detects MeshAgent payload 1 IoCs

resource	yara_rule
sample	family_meshagent

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-30_1691a8fa4fe2e385179017c844425cc9_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_sliver_stealc

File Explorer

2026-06-30_1691a8fa4fe2e385179017c844425cc9_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_sliver_stealc

.exe 5.5MB

2026-06-30_1691a8fa4fe2e385179017c844425cc9_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_sliver_stealc

IMPHASH b76ae5b600863303e5a3adc79dfd7e41
SHA256 372497b5730f77b313b41ca9f063c80f96a540c87b71381a1144e29979825e22
MD5 1691a8fa4fe2e385179017c844425cc9
SHA1 30ed245112a687e2cc773e8c31cd15ab0b67a77a
SHA512 802aa31b7f2916c2e8a449107eca985a52ced6317799dc0b2dda75b4752f54ea3c069890868e69bd2b09a13caebbe5579fddbe4eb3c80468f645836e591881a0
SSDEEP 49152:ROscD438gpfBVmwc/VXYC8nuyHnJV9bDpXxi5QbQqMaWvcqZGC5Wno/t2dJ0Ft26:Dck7YdKbDMmbQgCYoUjLNoUQ
TLSH
T1FA466D83FAAA40F4D47BE13855A26127F975B41203349BDBD2546A6F0F32FD0AA3E741
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects MeshAgent payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2851440

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Admin\Desktop\cbtmesh inclusive inject\Release-NoLogs\MeshService64.pdb

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

comctl32

InitCommonControlsEx

dbghelp

SymFromAddr MiniDumpWriteDump SymGetModuleBase64 SymGetLineFromAddr64 SymFunctionTableAccess64 StackWalk64 SymInitialize

iphlpapi

ConvertLengthToIpv4Mask SendARP GetAdaptersAddresses GetAdaptersInfo

ws2_32

htons htonl gethostname ntohs ntohl WSAGetLastError ioctlsocket recv send getsockname FreeAddrInfoW WSASocketW listen closesocket bind accept __WSAFDIsSet setsockopt socket WSASetLastError sendto getsockopt recvfrom connect shutdown WSAIoctl GetAddrInfoW WSAResetEvent WSAEventSelect WSAStartup WSACreateEvent WSACloseEvent select WSACleanup freeaddrinfo getaddrinfo

crypt32

CertDuplicateCertificateContext CertStrToNameW CertEnumCertificatesInStore CertGetCertificateContextProperty CertOpenStore CryptMsgCalculateEncodedLength CertDeleteCertificateFromStore CryptAcquireCertificatePrivateKey CertAddEncodedCertificateToStore CryptMsgClose CryptMsgUpdate CryptExportPublicKeyInfo CertCreateSelfSignCertificate CertFreeCertificateContext CryptMsgOpenToEncode CertAddCertificateContextToStore PFXExportCertStore CryptSignAndEncodeCertificate CertCloseStore CertStrToNameA CryptMsgGetParam CryptEncodeObject CertSetCertificateContextProperty CertFindCertificateInStore

wtsapi32

WTSQueryUserToken

gdiplus

GdiplusStartup GdipGetImageEncoders GdipCloneImage GdipDisposeImage GdipLoadImageFromStreamICM GdipAlloc GdiplusShutdown GdipFree GdipGetImageEncodersSize GdipSaveImageToStream GdipLoadImageFromStream

ncrypt

NCryptCreatePersistedKey NCryptFinalizeKey BCryptOpenAlgorithmProvider NCryptOpenStorageProvider BCryptGenRandom BCryptCloseAlgorithmProvider NCryptSetProperty NCryptFreeObject

shlwapi

PathFileExistsA

dwmapi

DwmSetWindowAttribute

kernel32

DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader RaiseException FlsAlloc GetFullPathNameW GetStdHandle WriteFile LoadLibraryExA GetModuleFileNameW GetSystemPowerStatus OpenProcess MultiByteToWideChar Sleep GetLastError CloseHandle GetCurrentDirectoryW SetCurrentDirectoryW GetProcAddress SetEnvironmentVariableA CreateProcessW FreeLibrary WideCharToMultiByte GetCurrentThreadId GetModuleHandleA WaitForSingleObjectEx CreateThread QueueUserAPC OpenThread ReadFile Process32First TerminateProcess CreateToolhelp32Snapshot LoadLibraryA Process32Next SleepEx SetSystemPowerState GetCurrentProcess SetThreadExecutionState HeapFree HeapAlloc GetProcessHeap SystemTimeToFileTime GetSystemTime FileTimeToSystemTime QueryPerformanceFrequency FlsGetValue QueryPerformanceCounter ReleaseSemaphore WaitForSingleObject CreateSemaphoreA CancelIo FindFirstFileW FindNextFileW RemoveDirectoryW GetFinalPathNameByHandleW GetDriveTypeA SetFilePointer FindFirstVolumeA FindClose CreateFileW GetVolumePathNamesForVolumeNameA GetFileAttributesExW ReadDirectoryChangesW FindNextVolumeA FindVolumeClose GetDiskFreeSpaceExA CreateEventA GetModuleHandleExA WaitForMultipleObjectsEx CreateNamedPipeA DisconnectNamedPipe CreateFileA CancelIoEx LocalFree ConnectNamedPipe SetConsoleMode GetConsoleMode SetConsoleOutputCP IsDebuggerPresent GetTempPathW CancelSynchronousIo SetEvent ResetEvent GetThreadId GetCurrentProcessId InitializeCriticalSectionEx FreeEnvironmentStringsA CopyFileW RtlCaptureContext SuspendThread ResumeThread DuplicateHandle ExitThread GetTickCount64 GetCurrentThread DeleteFileA GetOverlappedResult GetThreadContext WTSGetActiveConsoleSessionId GetExitCodeProcess SetEndOfFile DeleteFileW SetFilePointerEx WriteProcessMemory SetLastError EnterCriticalSection Module32Next LeaveCriticalSection InitializeCriticalSection Module32First K32GetModuleFileNameExA GetFileAttributesA GetSystemDirectoryA VirtualAllocEx DeleteCriticalSection CreateRemoteThread CreateProcessA VirtualFreeEx GetTickCount IsWow64Process GetModuleFileNameA SizeofResource FindResourceA OpenEventW LockResource GetWindowsDirectoryA LoadResource SetConsoleCtrlHandler GetFileSizeEx OutputDebugStringA CreateMutexW CreateMutexA HeapSize GetTempPathA FreeConsole GetWindowsDirectoryW ExitProcess GetConsoleWindow GetFileType LoadLibraryExW GetModuleHandleW SwitchToFiber DeleteFiber CreateFiber GetSystemTimeAsFileTime ConvertFiberToThread ConvertThreadToFiber GetEnvironmentVariableW ReadConsoleA ReadConsoleW FlsSetValue FlsFree RtlUnwind GetModuleHandleExW RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent CreateDirectoryW GetConsoleOutputCP MoveFileExW SetEnvironmentVariableW GetTimeZoneInformation SetStdHandle FreeLibraryAndExitThread GetDriveTypeW GetFileInformationByHandle PeekNamedPipe GetCommandLineA GetCommandLineW VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW EncodePointer InitializeSListHead GetStartupInfoW GetEnvironmentStrings SetUnhandledExceptionFilter HeapReAlloc FlushFileBuffers FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW SystemTimeToTzSpecificLocalTime CreateEventW

user32

GetClientRect GetUserObjectInformationW SendMessageA MessageBoxA SetWindowDisplayAffinity RegisterClassW SetTimer GetDlgItemTextA ShowWindow DialogBoxParamA EndDialog CreateWindowExW SetWindowPos GetWindowRect GetProcessWindowStation MessageBoxW PtInRect UpdateWindow InvalidateRect GetWindowThreadProcessId FindWindowExA GetWindowLongA GetWindowDisplayAffinity MessageBeep ExitWindowsEx DrawTextW UpdateLayeredWindow GetSystemMetrics SetThreadDesktop GetThreadDesktop CloseDesktop BlockInput GetMonitorInfoA OpenInputDesktop GetKeyState GetMessageA GetMessageExtraInfo DispatchMessageA LoadCursorA DestroyWindow GetDC PostMessageA GetIconInfo CallNextHookEx GetCursorInfo SetWindowsHookExA MapVirtualKeyA GetForegroundWindow UnhookWindowsHookEx DefWindowProcA CreateWindowExA TranslateMessage UnregisterClassA DrawIconEx SetWinEventHook RegisterClassExA UnhookWinEvent SetForegroundWindow ReleaseDC SendInput SetProcessDPIAware KillTimer PostQuitMessage EnumDisplayMonitors GetWindowLongPtrA SetWindowLongPtrA GetUserObjectInformationA

gdi32

CreateFontW CreateDIBSection DeleteObject GetPixel SetTextColor SetBkMode BitBlt StretchBlt DeleteDC SetStretchBltMode CreateCompatibleBitmap SelectObject CreateCompatibleDC GetDIBits GetObjectA

advapi32

SetServiceStatus DeregisterEventSource StartServiceCtrlDispatcherA AllocateAndInitializeSid CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptAcquireContextW ReportEventW RegisterServiceCtrlHandlerExA RegCreateKeyW RegSetValueExA RegDeleteKeyA RegCloseKey RegOpenKeyExA OpenProcessToken InitiateSystemShutdownA LookupPrivilegeValueA AdjustTokenPrivileges CryptReleaseContext RegSetValueExW CryptDestroyKey InitializeSecurityDescriptor SetEntriesInAclA SetSecurityDescriptorDacl DuplicateTokenEx CreateProcessAsUserW SetTokenInformation CreateProcessAsUserA CheckTokenMembership FreeSid RegisterEventSourceW

shell32

ShellExecuteExW

ole32

CoInitializeEx CoTaskMemFree CoCreateInstance CreateStreamOnHGlobal CoUninitialize

Name

.text

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

616KB

Virtual Size

615KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

615KB

Virtual Size

777KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

129KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2026-06-30_1691a8fa4fe2e385179017c844425cc9_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_sliver_stealc

userenv

comctl32

dbghelp

iphlpapi

ws2_32

crypt32

wtsapi32

gdiplus

ncrypt

shlwapi

dwmapi

kernel32

user32

gdi32

advapi32

shell32

ole32

generic