meshagent | 71144f6842b3b6f9c85b053c9d88027c3db9dbd8078edd1f07dc8d84e673f665 | Triage™

Login
Reports

Overview

overview

Static

static

2026-07-10...er.exe

windows10-2004-x64

2026-07-10...er.exe

windows11-ltsc_2024-x64

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_4262f746f56a20c7c2ef8dfb2e58b00d_amadey_coinminer_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader
Size 3.7MB
Sample260710-3z77tsat9v
SHA256 71144f6842b3b6f9c85b053c9d88027c3db9dbd8078edd1f07dc8d84e673f665
MD5 4262f746f56a20c7c2ef8dfb2e58b00d
SHA1 67ef6c54b2b89f8c4ad01bb1c6bc6a6cbe357c87
SHA512 428253b6b7e7a43fca670e2b4020e67c9097e49e80a3c30e8aee68c4bba2ea7620ed3fa1bfd4d8c7aba85ae22f151e359abd31cef05c3744d2e201f20a9ac55b
SSDEEP 49152:dXfEV3ugKtbRexQlNIdwB0pJCWJ0+1NaZPwqe5MZPa:hfEYdthWq+17KZPa
TLSH
T12806AEC2FB834071F4A736B410AB63BE997D79530728D4C3A2D429E989356E0AD37397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

meshagent sentinel connections backdoor defense_evasion discovery execution impact ransomware rat trojan

Static task

static1

3 signatures

sentinel connections rat trojan backdoor meshagent

Behavioral task

behavioral1

Sample

2026-07-10_4262f746f56a20c7c2ef8dfb2e58b00d_amadey_coinminer_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

10 signatures

150 seconds

backdoor sentinel connections defense_evasion discovery execution meshagent impact ransomware rat trojan

Behavioral task

behavioral2

Sample

2026-07-10_4262f746f56a20c7c2ef8dfb2e58b00d_amadey_coinminer_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader.exe

Resource

win11ltsc2024-20260709-en

windows11-ltsc_2024-x64

10 signatures

150 seconds

backdoor sentinel connections defense_evasion discovery execution meshagent impact ransomware rat trojan

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

Sentinel Connections

C2

http://meshserver.net:443/agent.ashx

Attributes

mesh_id
0x8CD5A26AEEC0CAE34887959E8BB7B59405EAAFA59D881B900A107C7E15E4903CA2938A5C3F0376B3970E6098DBEEED2A
server_id
17FE2257E50AE3385ACEC631087405613193F8D5C915B47F123D049FB525022969CA4D12B37B50C77B3D3D4BF886BC66
wss
wss://meshserver.net:443/agent.ashx

Targets

- Target
  2026-07-10_4262f746f56a20c7c2ef8dfb2e58b00d_amadey_coinminer_elex_glassworm_luca-stealer_njrat_remcos_smoke-loader
- Size 3.7MB
- SHA256 71144f6842b3b6f9c85b053c9d88027c3db9dbd8078edd1f07dc8d84e673f665
- MD5 4262f746f56a20c7c2ef8dfb2e58b00d
- SHA1 67ef6c54b2b89f8c4ad01bb1c6bc6a6cbe357c87
- SHA512 428253b6b7e7a43fca670e2b4020e67c9097e49e80a3c30e8aee68c4bba2ea7620ed3fa1bfd4d8c7aba85ae22f151e359abd31cef05c3744d2e201f20a9ac55b
- SSDEEP 49152:dXfEV3ugKtbRexQlNIdwB0pJCWJ0+1NaZPwqe5MZPa:hfEYdthWq+17KZPa
- TLSH
  T12806AEC2FB834071F4A736B410AB63BE997D79530728D4C3A2D429E989356E0AD37397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor sentinel connections defense_evasion discovery execution meshagent impact ransomware rat trojan
- Detects MeshAgent payload
- Family: MeshAgent
  MeshAgent is an open source remote access trojan written in C++.
  rat trojan backdoor meshagent
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

Indicator Removal

File Deletion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

sentinel connectionsrattrojanbackdoormeshagent

behavioral1

backdoorsentinel connectionsdefense_evasiondiscoveryexecutionmeshagentimpactransomwarerattrojan

behavioral2

backdoorsentinel connectionsdefense_evasiondiscoveryexecutionmeshagentimpactransomwarerattrojan

© 2018-2026

Terms | Privacy