Extracted

• • Target
    2026-07-01_ccc3d4fcafea90ad2bf6e115a45d0656_coinminer_glassworm_icedid_njrat_ryuk_sliver
  • Size 3.3MB
  • SHA256 c961453707bcdc863f3e9e62b7a6b1f9ada38cfea7fe6a424e02cad145e284d9
  • MD5 ccc3d4fcafea90ad2bf6e115a45d0656
  • SHA1 43c6d367f0b74d06320298692079694da8ee7b7c
  • SHA512 cfd174b636cd3d509c39dfd62816dc7942d5767256e8568fabfceb6f36ece7204106e1e0961af82a96b6b597afe3e816156bcc9108e9cde76b721ac619a6a17c
  • SSDEEP 49152:SX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Qv:SlRsZ47/QXoHUOfAoj1x6v
  • TLSH
    T117F57CD2A7A600E8E977F23C89568517E7F1B81353709BCF15A44A660F236E12B3F712
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebackdoortacticalrmmdiscoveryexecutionmeshagentpersistenceransomwareratspywaretrojan

  • Detects MeshAgent payload

  • Family: MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

    rattrojanbackdoormeshagent

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2