Extracted

• • Target
    2026-07-09_7150c39e04522b00f8b9f7e2bb09e179_coinminer_glassworm_icedid_njrat_ryuk_sliver
  • Size 2.9MB
  • SHA256 5c8693dc9aec2d9482fbc751ed4ead9d0375df8ffd89f4bd07a152285dd5c4cc
  • MD5 7150c39e04522b00f8b9f7e2bb09e179
  • SHA1 7f5967173061b112c1d10afc9dcb4728232fbb6f
  • SHA512 17bb5b0cd9e767ed24b7fe7a257e70da9d4d10e2779825ede4bcfc3a766b2f219eb287f1a1f582b3d3428d919c5630b3f55cb47fed08ef6bb5c3d2f4c5634636
  • SSDEEP 49152:biQagHg5EVhwQd+qrW+i1w+Tqc0KxZbDOCwMDbyeKw3FGMFvfjPW21I3iIJv:+g7hRdj9iMlHBSFBWZv
  • TLSH
    T124E58C52A7A800E8D9B7C178C9568517D7F2F81123709BDF06A85A7A0F23AE12F3F715
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorintertradediscoverymeshagentpersistencerattrojanadwareransomwarespyware

  • Detects MeshAgent payload

  • Family: MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

    rattrojanbackdoormeshagent

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2