Overview

overview

10

Static

static

10

2026-07-04...er.exe

windows10-2004-x64

10

2026-07-04...er.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    2026-07-04_e0253c7bbc5b4e8dbc6ea231f51ea800_coinminer_glassworm_icedid_njrat_sliver
  • Size 4.6MB
  • Sample260704-vmfytaes2k
  • SHA256 e061a76a42aead05e3cf7161b65a73fb8e6f074a0a2aba1b3817eae9ef659491
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
meshagentaaabackdoordiscoveryexecutionpersistencerattrojan

Malware Config

Extracted

Family

  • meshagent

Version

  • 2

Botnet

  • aaa

C2

  • http://enroll.azuredevice.cloud:443/agent.ashx

Attributes
  • mesh_id

    0x8A39E8291982FB5022E480E2FC5DB2D3471C720BC2338B112B5D7A4E7C91B7E61D847738FE82C04769328CDA79C85763

  • server_id

    7D220BA020FCE6ABA736FC5B7F580B5A7B8C06BDD915281C20D44ECE897339B699517EF5E5ACB01CC9BB44387ECCB0D7

  • wss

    wss://enroll.azuredevice.cloud:443/agent.ashx

Targets

    • Target
      2026-07-04_e0253c7bbc5b4e8dbc6ea231f51ea800_coinminer_glassworm_icedid_njrat_sliver
    • Size 4.6MB
    • SHA256 e061a76a42aead05e3cf7161b65a73fb8e6f074a0a2aba1b3817eae9ef659491
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    backdooraaadiscoveryexecutionmeshagentpersistencerattrojan

    • Detects MeshAgent payload

    • Family: MeshAgent

      MeshAgent is an open source remote access trojan written in C++.

      rattrojanbackdoormeshagent

    • Sets service image path in registry

      This determines the executable launched when a service starts. It can be used to establish persistence.

      persistence

    • Executes dropped EXE

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks