Extracted

• • Target
    2026-07-04_26db2045d911717d48d5fb316127f9ba_coinminer_glassworm_icedid_njrat_ryuk_sliver
  • Size 3.4MB
  • SHA256 533f44ca1eda1f2b603dab1c6db38b62c5c379421633450065ec4236024febc6
  • MD5 26db2045d911717d48d5fb316127f9ba
  • SHA1 be8963cf39b815286f29a19a45b09bff1a593741
  • SHA512 5a8793eb8152419403982d9cef05d7d48018cfea21100aaf4cd191ffb517388cfcbeeea5fb0c465b7799c5ef86e084c1c4804772146594a9f4d3a87e3f2f87d5
  • SSDEEP 49152:XdZEy2B6vflQf6X8uZQoy3vR6QVQy5Z+bm4M/HMFvfGW0/7Z7Ib3jxj5Y:tHvfGfZvZj1/N/z/ojG
  • TLSH
    T123F58DD2A3A600E8E9B7F23C85568517E7F1B81753709BCF16A44A761F236D12B3E702
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebackdoorkishorediscoveryexecutionmeshagentpersistenceransomwareratspywaretrojan

  • Detects MeshAgent payload

  • Family: MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

    rattrojanbackdoormeshagent

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2