General

  • Target
    2026-07-12_a761bf8921a9cb4bef1b19206605ef22_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
  • Size 5.0MB
  • Sample260712-twelnsc16p
  • SHA256 cc54a5630b131da56b8776c879e6d1a36bbb3c3533fa13ea60c2438ca21bf412
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Extracted

Family
  • supershell

C2
  • 2.11.03.11.93.14.532 bit39062564 bit<-chanAacuteAcceptAckAllActiveAgraveAnswerApiURLArabicAtildeAugustAuthorBasic BearerBinaryBitBltBrahmiBypassCANCELCDATA[CLOSEDCarianCcedilChakmaClosedCommonCookieCopticCreateCustomDELETEDaggerEEPROMEacuteEgraveEndDocExpectFEPROMFormatFridayGOAWAYGetACPGetAceGothicHangulHatranHebrewHiddenHyphenIacuteIgraveIsMenuKaithiKhojkiLISTENLPDDR2LPDDR3LPDDR4LambdaLengthLepchaLineToLockedLycianLydianManualMondayMulDivNtildeOacuteOgraveOslashOtildePADDEDPING PONG PatBltPragmaREG_SZRejangSCHED STREETSTRINGSYSTEMScaronSearchServerSourceStatusStringSundaySymbolSyriacSystemTai_LeTangutTargetTeluguThaanaTmpDirTypeMXTypeNSUTC+12UTC+13UTC-02UTC-08UTC-09UTC-11UacuteUgraveUserIdWARN: WINDIRWanchoWeeklyWeightX25519YacuteYezidi[%d]%s[]byte\u%04X\u0000\u0001\u0002\u0003\u0004\u0005\u0006\u0007\u0008\u000b\u000e\u000f\u0010\u0011\u0012\u0013\u0014\u0015\u0016\u0017\u0018\u0019\u001a\u001b\u001c\u001d\u001e\u001f\u0022\u0026\u0027\u002b\u003c\u003e\u0060\u2028\u2029\ufffd _amd64aacuteacceptactionactiveagravearray*atildeavx512binaryborderbrvbarbuild bytes*ccedilcentoschan<-closedcmd_idconptycookiecoordscurrendaggerdebiandefinedeletedividedomaineacuteefenceegraveempty env.nuexec: existsexpectfedoraforallfrac12frac14frac34go %s goarchgopherhangupheaderheartsheighthelliphiddeniacuteigraveimportinternip+netiquestkMGTPEkilledlambdalfloorlistenlowastlsaquomailtomethodmiddotminutemonthsnats: natswsnetdnsnomeshntildenu.exenumbernutempoacuteobjectograveoriginoslashotildeotimesoutputpausedpermilplusmnpopcntposterprintfpythonquery:rdrandrdseedrdtscpreadatredhatremoverenamereturnrfloorrsaquorune1 scaronscopedscriptsecondselectsendtoserversigmafsilentsimplesocketsocks socks5spadessrcdocsrcsetstate(statusstdoutstringstructsweep switchsysmontargettelnetthere4thinsptimerstmpdirtypeofuacuteubuntuugraveuint16uint32uint64unusedusemapvaluesweierpwinptyx86_64xmlns:yacute{ARCH} %v=%v, (conn) (scan (scan) MB in Value> action allocs dying= flags= len=%d locks= m->g0= nmsys= pad1= pad2= s=nil text= using zombie% CPU (%s %s; %s://%s%v days%v hour%v week%v year%v: %#x, goid=, j0 = , type=--force-nodeid/LOG=%s19531252.5.4.32.5.4.52.5.4.62.5.4.72.5.4.82.5.4.99765625: type ::ffff::method:scheme:status= "`API URLAckNoneActionsAgentIDAgentPKAvestanBaseURLBengaliBrailleCLOSINGCOMMENTCONNECTChanDirClassIdConnectContactContextConvertCopySidCreatedCypriotDEBUG: DeseretERROR: Ed25519ElbasanEllipseElymaicEnabledEndMenuEndPageEpsilonExpiresFATAL: FreeSidGNUStepGODEBUGGetMenuGetTaskGranthaGroupIdHEADERSHanunooILLEGALIM UsedIO waitInstAltInstNopInstallJanuaryKannadaMD2-RSAMD5-RSAMUI_DltMUI_StdMakasarMandaicMarchenMaskBltMeshDirMonthlyMultaniMyanmarNewTaskOctoberOmicronOsmanyaPATHEXTPolygonRadicalRefererSELECT SHA-224SHA-256SHA-384SHA-512SUCCESSServiceSetMenuSetRectSharadaShavianSiddhamSinhalaSite IDSleepExSogdianSoyomboSubjectSwapperTagalogTask PKTibetanTirhutaToAsciiTrailerTuesdayTypeALLTypeOPTTypePTRTypeSOATypeSRVTypeTXTTypeWKSUNKNOWNUnknownUpdatesUpgradeUpsilonUsage: VersionWARNINGWSARecvWSASend[INFO] "`'/<-#\\.\UNC\ ) types value=_structabortedalefsymallocmRallocmWalt -> amxbf16amxint8amxtileanswersany -> archiveavx512fbdoUxXvbooleanbucket(charsetcheckedchunkedclassidclosurecmd.execolspancommandcomplexconnectconsolecontentcpuprofdefaultderiveddirnameenctypeepsilonexpiresfailingfields.finallyfloat32float64forcegcgctracehead = headershttp://installinstantintegerinvalidkeytypelognamelookup manjaromeshdirminpc= minutesmpr.dllmsgpacknil keynop -> number nushellomicronoperandoptimumosxsavepacer: packagepanic: passingpatternpdh.dllpreloadprintlnprofilepubdatereaddirrefererrefreshrestartresultsrowspanrunningsandboxsecondsserial:signal site-idspecialsrclangstoppedstring*subkeyssuccesssyscalltimeouttraileruintptrunknownupgradeupsilonversionwaitingwindowswsarecvwsasend{{end}} bytes, data=%q etypes incr=%v is not maxpc= mcount= minLC= minutes nalloc= newval= nfreed= packed= ping=%q pointer stack=[ status xmlns="%!Month(%.10q...%.1f %cB%02d%02d%25s: %s%s %s:%d%s /C %s%s&#x%x;%s: %s %s;%s;%s%v hours%v month%v weeks%v years&#xfffd;--config012345672.5.4.102.5.4.112.5.4.172006010248828125AbortDocAcceptExAcceptedAngleArcArmenianBAD RANKBalineseBopomofoBugineseCLICOLORCancelIoCherokeeClassANYComputerConflictContinueCopyRectCurveID(CyrillicDNS nameDSA-SHA1DecemberDeleteDCDisabledDownloadDrainingDrawIconDuployanDurationDwmFlushEndPaintEqualSidEthiopicExtenderFebruaryFillRectFullPathGeorgianGetFocusGetTasksGoStringGujaratiGurmukhiHOMEPATHHTTP/1.1HTTP/2.0HelpLinkHiraganaIdentityInsecureInstFailInstRuneIntervalIsWindowJavaneseKatakanaKayah_LiLAST_ACKLinear_ALinear_BLocationMD5+SHA1MD5-sessMahajaniMoveToExNO_ERRORNO_PROXYNode id:NovemberOl_ChikiOpenStepPRIORITYParseIntPasswordPhags_PaPolylinePriorityPtInRectQuestionReadFileReceivedResetDCWRunLevelSETTINGSSHA1-RSASHA3-224SHA3-256SHA3-384SHA3-512SYN_SENTSameSiteSaturdaySetEventSetFocusSetTimerSettingsSystem32TagbanwaTai_ThamTai_VietTextOutWThursdayTifinaghToken %sTriggersTypeAAAATypeAXFRUgariticUpdateIDWSAIoctlZgotmplZ[::1]:53[:word:][ERROR] [signal "%s" %s 

 --%s stack=[_NewEnum_gatewayaddress agent_idantergosautoplayavx512bwavx512cdavx512dqavx512eravx512pfavx512vlbad instbeEfFgGvcgocheckcodebasecomp_syscompresscontinuecontrolscs curl -X datetimedeadlockdeno.exedenotempdisableddnsquerydropzonedurationencodingexecwaitexplicitexporterfile+netfinishedfont/otffont/ttffs graphicsgs has_morehijackedhostnamehreflanghttp/1.1if-matchif-rangeinfinityinsecureinvalid ip4:icmpis-*.tmplanguagelinkpathlocationlongdescloopbacklstrcpyWlstrlenWmanifestmultiplenats: %snatsportnew_namenew_pathno anodeno-cacheno_proxynssm.exeold_nameold_patholeaut32opensuseoriginalpanic %vpath %s photurispollDescpy38-x32py38-x64r10 r11 r12 r13 r14 r15 r8 r9 raspbianrax rbp rbx rcx rdi readfromreadonlyrecvfromredirectrequiredreversedrflags rip rsi rsp runnablescavengeseamlessselectedshutdownsockaddrsoftwarestrconv.syncmeshtabindextemplatetextareathetasymtraceBuftrigger=unixgramunknown(updtCnt:urlquerywsaioctlx509sha1{{else}} (forced) -> node= B exp.) B work ( as type blocked= in use) lockedg= lockedm= m->curg= marked ms cpu, not in [ of type runtime= s.limit= s.state= threads= unmarked wbuf1.n= wbuf2.n=#ZgotmplZ%s %q: %s%s %x %x %v minute%v months%v second(unknown), newval=, oldval=, size = , tail = 01234567_0x%X (%d)1 error: 244140625: status=AUOptionsAgent ID:Agent PK:ArgumentsAuthorityAutomaticBase URL:Bassa_VahBhaiksukiBigEndianCONNECTEDCheckInSWClassINETClient IDCreateDCWCreateICWCreatePenCuneiformDiacriticDrawTextWEndDialogEqualRectEvery dayExecQueryFindCloseForbiddenGetDIBitsGetFolderGetWindowHOMEDRIVEHex_DigitInheritedInstMatchInstRune1InterfaceKhudawadiLoadIconWLoadMenuWLocalFreeLogonTypeMalayalamMongolianMoveFileWNabataeanNot FoundOnFailurePalmyreneParseBoolParseUintPrincipalPublisherPurgeCommREG_DWORDREG_QWORDRPC debugRectangleReleaseDCReleaseIdRemoveAllRun Task:SamaritanSee OtherSendInputSeptemberSetBkModeSetCursorSetupCommStartDocWStartPageStartTypeSundaneseSyncMesh:TIME_WAITTimestampToo EarlyTrailer: TypeCNAMETypeHINFOTypeMINFOUnionRectUse ProxyWSASendToWakeToRunWednesdayWinTmpDirWriteFile[%v = %d][:^word:][:alnum:][:alpha:][:ascii:][:blank:][:cntrl:][:digit:][:graph:][:lower:][:print:][:punct:][:space:][:upper:]_outboundagent-wmiagent.logalmalinuxatomicor8autofocusautomaticbad indirbad prunebroadcastbus errorchallengechan sendchoco.execlient-idcomplex64config.nuconnectexconpty-incopystackcpu-totalctxt != 0d.nx != 0dns,filesdraggabledxva2.dllelement <empty urlexit_codefiles,dnsfont/wofffork/execfuncargs(gdi32.dllgetCallerhchanLeafimage/bmpimage/gifimage/pnginittraceinterfaceinterruptinvalid nipv6-icmplinuxmintlocalhostmSpanDeadmap[%s]%smaxlengthmeshagentmkdirtempmulticastnil errornil tracentdll.dllole32.dllomitemptyopeneulerpage_sizepanicwaitpclmulqdqpreemptedprofBlockprotocol psapi.dllquestionsrecover: reflect: runchecksrwxrwxrwxscavtracestackpoolstartTypesucceededtimestamptracebackundefinedunderflowunhandleduninstallurn:uuid:video/avivideo/mp4wbufSpanswebsocketwinmm.dllwsasendto{VERSION}{{break}}} stack=[ netGo = MB goal, but have flushGen for type gfreecnt= heapGoal= pages at ptrSize= runqsize= runqueue= s.base()= spinning= stopwait= stream=%d sweepgen sweepgen= targetpc= throwing= until pc=%!Weekday(%s|%s%s|%s%v minutes%v seconds, bound = , limit = -NoProfile.localhost.terminal./dev/stdin/etc/hosts/r /t 5 /f012345678912207031256103515625: parsing :authority<no value>AcceptEulaAdditionalAll monthsAlphaBlendBad varintBeginPaintCLOSE_WAITCONNECTINGCache DRAMCancelIoExCategoriesCategoryIDCheckInWMIChorasmianClassCHAOSClassCSNETCombineRgnConnectionContent-IdCreateFileCreateIconCreateMenuCreatePipeDSA-SHA256DaysOfWeekDefinitionDeleteMenuDeleteTaskDeprecatedDevanagariDnsQuery_WDragFinishDrawIconExECDSA-SHA1END_STREAMEnable RDPEvery weekException FIN_WAIT_1FIN_WAIT_2GC forced GOMAXPROCSGOMEMLIMITGetDlgItemGetFoldersGetIfEntryGetObjectWGetSubMenuGetVersionGlagoliticGlobalFreeGlobalLockHKEY_USERSHTTP_PROXYHost: %s IP addressIgnore NewInstalled:IsValidSidKeep-AliveKharoshthiLoadImageWLocalAllocLockFileExManichaeanMesh AgentMessage-IdMoveWindowNATS/1.0 NetUserAddNetUserDelNo ContentOffsetRectOld_ItalicOld_PermicOld_TurkicOpenEventWOpenMutexWOpenThreadOther_MathPOSTALCODEParseAddr(ParseFloatPhoenicianPingCheck:PlaySoundWPolyBezierProcessingPulseEventREG_BINARYRIPEMD-160RST_STREAMRemoveMenuRepetitionResetEventSHA256-RSASHA384-RSASHA512-RSASYSTEMROOTSaurashtraSend EmailSet-CookieSetBkColorSetCaptureShcore.dllShowCursorShowWindowStatus: %sStretchBltSupportURLSynch DRAMUNKNOWN_%dUser-AgentWSACleanupWSASocketWWSAStartupWindows 10Windows 11[:^alnum:][:^alpha:][:^ascii:][:^blank:][:^cntrl:][:^digit:][:^graph:][:^lower:][:^print:][:^punct:][:^space:][:^upper:][:xdigit:] --%s-- _reserved1agent-typearg %d: %watomicand8audio/aiffaudio/midiaudio/mpegaudio/waveavx512bf16avx512gfniavx512ifmaavx512vaesavx512vbmiavx512vnnibackgroundbase_boardcomplex128connectionconpty-outcreatetempdebug calldefinitiondnsapi.dlldwmapi.dllecho replyexecerrdotexitThreadexp masterfloat32nanfloat64nanfont/woff2formactionformmethodformtargetgetsockoptgoroutine http-equivhttp_proxyimage/avifimage/jpegimage/webpimpossibleinstanceofinvalid IPinvalidptrkeep-alivelocal-meshmSpanInUsemediagroupmesh agentmeshnodeidnil headernot a boolnotifyListnovalidateowner diedpowershellprofInsertpython.exeradiogroupres binderres masterresumptionrune <nil>runtime: gs.state = schedtracescientificsemacquiresession_idset-cookiesetsockoptskipping: socks bindspellcheckstackLarget.Kind == terminatedtracefree(tracegc() unins*.exeunixpacketunknown pcuser-agentuser32.dllvideo/webmwinagent-vwinpty.dllws2_32.dll of size (targetpc= , plugin: ErrCode=%v KiB work, exp.) for freeindex= gcwaiting= idleprocs= in status mallocing= ms clock, nBSSRoots= p->status= s.nelems= schedtick= span.list= timerslen=%d errors: %d.%d.%d.%d%s %s %s ) at entry+, elemsize=, npages = , settings:--no-prompt.WithCancel.cmdoutput./VERYSILENT/dev/stderr/dev/stdout/index.html0123456789_0x%08X (%d)30517578125: frame.sp=> in space AckExplicitAppendMenuWBLAKE2b-256BLAKE2b-384BLAKE2b-512BLAKE2s-256Bad GatewayBad RequestCOM HandlerClassHESIODCloseHandleCoGetObjectCookie.PathCreateFileWDaysOfMonthDefDlgProcWDeleteFileWDescriptionDestroyIconDestroyMenuDisplayNameDives_AkuruDownloaded:DrawMenuBarENABLE_PUSHEND_HEADERSESTABLISHEDEarly HintsEnable pingEndBoundaryEnumWindowsEnvironmentExitProcessFileVersionFindWindowWFreeLibraryGOMEMLIMIT=GOTRACEBACKGetFileTimeGetFileTypeGetIfEntry2GetKeyStateGetMenuInfoGetMessageWGetSysColorGetWindowDCGlobalAllocHTTPS_PROXYIdeographicIn-Reply-ToInflateRectInsertMenuWInstCaptureInstRuneAnyInstallDateInteractiveIsInstalledIsRectEmptyLastRunTimeLoadCursorWMachineGuidMarshalJSONMarshalTextMedefaidrinMesh Agent:Mesh agent:MessageBeepMessageBoxWModifyMenuWMoveFileExWNATS error:NandinagariNetShareAddNetShareDelNetUserEnumNew_Tai_LueNextRunTimeOld_PersianOld_SogdianOpenProcessPROGRAMDATAPatchMgmnt:Pau_Cin_HauPrintWindowProductNameRandomDelayRegCloseKeyReturn-PathSHA-512-256SHA-512/224SHA-512/256SYSTEMROOT=Sending WMISetCommMaskSetFileTimeSetMenuInfoSignWritingSoft_DottedStateChangeSwapBuffersSystemDriveTTL expiredTacticalRMMToUnicodeExUSERPROFILEUserenv.dllVariantInitVirtualFreeVirtualLockWARN RESTY WSARecvFromWaitMessageWaitTimeoutWarang_CitiWhite_Space[:^xdigit:]\device\mup_eval_args_additionalsagent-disksagent-helloalarm clockassistQueueauthoritiesavx512vbmi2avx512vnniwbad addressbad argSizebad m valuebad messagebad timedivbad verb '%broken pipecall of nilcgocall nilcheckrunnerclobberfreeclosesocketcombase.dllcontextmenucreated by crossorigincrypt32.dlldescriptionempty fieldexpected :=fallthroughfile existsfinal tokenfloat32nan2float64nan1float64nan2float64nan3formenctypegccheckmarkgdiplus.dllgetpeernamegetsocknameglobalAllochttp2clienthttp2serverhttps_proxyi/o timeoutlocal errormSpanManualmethodargs(minTrigger=msimg32.dllmswsock.dllnetpollInitnil Contextnil contextnot definedoraclelinuxparse errorplaceholderraw-controlreflect.SetreflectOffsretry-afterruntime: P runtime: g runtime: p scheddetailsechost.dllsecur32.dllshell32.dllshort writestack tracetacticalrmmtls: alert(tls://%s:%stracealloc(traffic updunreachableunsupporteduserenv.dllversion.dllwinagent-v*winpty_freewinpty_openwsarecvfromwss://%s:%s (sensitive) = struct { B (∆goal KiB total, MB stacks, [recovered] allocCount found at *( gcscandone m->gsignal= maxTrigger= nDataRoots= nSpanRoots= pages/byte preemptoff= s.elemsize= s.sweepgen= span.limit= span.state= sysmonwait= wbuf1=<nil> wbuf2=<nil>%02d-%d-%02d) p->status=, cons/mark --env-config-byte limit -fullinstall100-continue127.0.0.1:53152587890625762939453125> but have <Agent token:BODY : %v Bidi_ControlCIDR addressCONNECT %s CONTINUATIONCfgMgr32.dllCheckInDisksCheckInHelloCheckInPubIPCoCreateGuidCoInitializeContent TypeContent-TypeCookie.ValueCreateBitmapCreateCursorCreateEventWCreateFolderCreateMutexWCurrentBuildCustomSourceDDR2 FB-DIMMDEBUG RESTY DISCONNECTEDDaysIntervalDeleteObjectECDSA-SHA256ECDSA-SHA384ECDSA-SHA512ERROR RESTY EnableWindowEulaAcceptedExtCreatePenExtractIconWFindNextFileGetAddrInfoWGetCommStateGetConsoleCPGetCursorPosGetDlgCtrlIDGetLastErrorGetLengthSidGetMenuStateGetProcessIdGetStdHandleGetTempPathWGetTopWindowGlobalUnlockHEADERS: %s HOST : %s I'm a teapotIdleDurationIdleSettingsInstAltMatchIsDownloadedJoin_ControlKBArticleIDsLittleEndianLoadLibraryWLoadResourceLockResourceMax-ForwardsMeetei_MayekMesh Node IDMime-VersionMissing pathMonthsOfYearMoreInfoURLsMsrcSeverityMulti-StatusNeedsReboot:Netapi32.dllNot ExtendedNot ModifiedNtCreateFileOpen ServiceOpenServiceWPROGRAMFILESPUSH_PROMISEPahawh_HmongPdhOpenQueryPeekMessageWPostMessageWProgramFilesPublicIP errRCodeRefusedRCodeSuccessRECONNECTINGREG_MULTI_SZReadConsoleWRedrawWindowRegGetValueWReleaseMutexReportEventWRestartCountResumeThreadRevertToSelfRoInitializeRun ParallelRunning taskSERIALNUMBERSHA-256-sessSYN_RECEIVEDSameSite=LaxScrollWindowSelectObjectSendMessageWSession LockSetCommBreakSetCommStateSetConsoleCPSetCursorPosSetEndOfFileSetErrorModeSetLocalTimeSetRectEmptySetStdHandleSetTextColorSetWindowPosSetupAPI.dllShow MessageSlowConsumerSora_SompengSubscriptionSubtractRectSyloti_NagriSysStringLenTactical RMMTacticalRMM_Thread32NextTransmitFileUnauthorizedUnlockFileExUpdateWindowUsing proxy:ValidateRectValueQueriesVariantClearVersionMajorVersionMinorVirtualAllocVirtualQueryWeeksOfMonthX-ImforwardsX-Powered-Byabi mismatchadvapi32.dllagent-winsvcaltmatch -> anynotnl -> autocompleteavx5124fmapsavx512bitalgbad flushGenbad g statusbad g0 stackbad recoveryblock clausebuild %s=%s c ap trafficc hs trafficcaller errorcan't happencas64 failedchan receiveclose notifycomctl32.dllcomdlg32.dllcontent-typecontext.TODOdumping heapecho requestend tracegc entersyscallexit status gcBitsArenasgcpacertracegetaddrinfowharddecommithost is downhttp2debug=1http2debug=2illegal seekimage/x-iconinvalid baseinvalid bodyinvalid kindinvalid pathinvalid portinvalid slotiphlpapi.dllkernel32.dlllfstack.pushlogrus_errormadvdontneedmax-forwardsmesh_node_idmheapSpecialmissing pathmspanSpecialnetapi32.dllno extensionno such hostnot pollablenssm-x86.exentoskrnl.exeoleaut32.dllopengl32.dllout of rangepointtopointproxyconnectrandautoseedrecv_goaway_reflect.Copyregistrationreleasep: m=remote errorruntime: gp=runtime: sp=s ap traffics hs trafficself-preemptservices.exesetupapi.dllshort buffershutdown.exespanSetSpinestop_pendingstring|bytessweepWaiterstacticalrmm*traceStringstransmitfileunexpected )unins000.exeunknown portunknown typewinpty_bins/winpty_spawnwintrust.dllwirep: p->m=worker mode wtsapi32.dll{{continue}} != sweepgen (default %q) (default %v) MB globals, MB) workers= [%dm%s= called from closed by </ flushedWork idlethreads= in duration in host name is nil, not nStackRoots= out of range pluginpath= s.spanclass= span.base()= syscalltick= work.nproc= work.nwait= %s://%s:%d/%s, gp->status=, not pointer--WebProxy=%s--no-progress-byte block (3814697265625: unknown pc <unsupported>AUDIT_FAILUREAUDIT_SUCCESSAccept-RangesAuthorizationCLIENT_RANDOMCONNECT_ERRORCPU Load Avg:Cache-ControlCertOpenStoreCheckInWinSvcCheckMenuItemCloseEventLogCoTaskMemFreeCompatibilityConnectServerContent-RangeCreateActCtxWCreateRectRgnCreateWindowWDRAINING_PUBSDRAINING_SUBSDeleteServiceDestroyCursorDestroyWindowDocumentationECDSAWithSHA1EnumProcessesEstimatedSizeExitWindowsExFQDN too longFindFirstFileFindNextFileWFindResourceWForcing ipv4:FreeAddrInfoWGC sweep waitGetClassLongWGetClassNameWGetClientRectGetDeviceCapsGetDriveTypeWGetIfEntry2ExGetMenuItemIDGetSystemMenuGetSystemTimeGetWindowInfoGetWindowRectGo CPU Check:Gunjala_GondiIIDFromStringIf-None-MatchImageList_AddInstallSourceIntersectRectInvalid monthLast-ModifiedLoop DetectedMapViewOfFileMasaram_GondiMende_KikakuiMeshAgent.exeModule32NextWNatsProxyPathNatsProxyPortNot InstalledOld_HungarianOpenClipboardOpenEventLogWPKCS1WithSHA1PdhCloseQueryREG_EXPAND_SZRPC RunChecksReadEventLogWRegDeleteKeyWRegEnumKeyExWRegEnumValueWRegOpenKeyExWReset ContentRestartOnIdleRtlCopyMemoryRtlGetVersionRtlInitStringRtlMoveMemoryRunOnlyIfIdleSHA256-RSAPSSSHA384-RSAPSSSHA512-RSAPSSSTREAM_CLOSEDSafeArrayCopySafeArrayLockSelectClipRgnSetBrushOrgExSetClassLongWSetDCPenColorSetSystemTimeShellExecuteWStartBoundaryStartServiceWStop ExistingStopOnIdleEndStringFromIIDSysFreeStringTacticalAgentThe log levelThread32FirstUNSUB %d %s Unknown ErrorUpdateID='%s'Usage of %s: VirtualUnlockWINDOW_UPDATEWTSFreeMemoryWaitCommEventWeeksIntervalWriteConsoleW[FrameHeader accept-rangesaccess deniedauthorizationbad flushGen bad map stateby_start_timecache-controlcomp_sys_prodcontent-rangedalTLDpSugct?define clausedouble unlockemail addressempty commandempty integerexchange fullexecRInternalfatal error: getTypeInfo: gethostbynamegetservbynamegzip, deflateif-none-matchimage/svg+xmlinvalid ASN.1invalid UTF-8invalid base ip6:ipv6-icmplame referrallast-modifiedlevel 3 resetload64 failedmeshagent.exemin too largenats: timeoutnil stackbaseno name spacenot a Float32not availableout of memoryparsing time pause_pendingprofMemActiveprofMemFutureruntime: seq=runtime: val=socks connectsrmount errorstart_pendingtestRInternaltime exceededtimeEndPeriodtimer expiredtlsmaxrsasizetraceStackTabtrmm/%s/%s/%sunexpected %sunimplementedunknown type unsupported: updaterunninguser canceledvalue method wglShareListsxadd64 failedxchg64 failed} sched={pc: /* %s */null needspinning= nmidlelocked= on zero Value out of range procedure in to finalizer untyped args %v, Attempt %v-fulluninstall-thread limit .WithDeadline(/api/v3/choco/1907348632812595367431640625: extra text: <not Stringer>> closed by </Accept-CharsetActivateActCtxAgentStartup()CLICOLOR_FORCECallNextHookExCertCloseStoreClearCommBreakClearCommErrorClientToScreenCloseClipboardCoInitializeExCoUninitializeComputerNameExContent-LengthControlServiceCreateEventExWCreateMutexExWCreateProcessWCreateServiceWCryptGenRandomCurrentVersionDefWindowProcWDisplayVersionDkim-SignatureDragQueryFileWDragQueryPointDuplicateTokenDwmEnableMMCSSDwmShowContactERR_UNKNOWN_%dEmptyClipboardEnableMenuItemEnumPageFilesWFindFirstFileWFormatMessageWGC assist waitGC worker initGdiplusStartupGetConsoleModeGetMenuBarInfoGetMenuStringWGetMessageTimeGetPixelFormatGetProcAddressGetShellWindowGetStockObjectGetSystemTimesGetTickCount64GetUserNameExWGetWindowLongWGetWindowTextWHiliteMenuItemINTERNAL_ERRORInstEmptyWidthInvalid ActionInvalidateRectIsWellKnownSidIsWow64ProcessLastTaskResultLoadLibraryExWMAX_FRAME_SIZEMB; allocated MakeAbsoluteSDMapVirtualKeyWModule32FirstWNetUserGetInfoNetUserSetInfoNot AcceptableOpenSCManagerWOther_ID_StartPROTOCOL_ERRORPattern_SyntaxPrints versionProcess32NextWPublicIP startQuotation_MarkRCodeNameErrorREFUSED_STREAMREQUEST_METHODReboot needed:RegDeleteTreeWRegSetValueExWReleaseCaptureRemote ConnectResourceHeaderRevisionNumberRunPythonCode:Running checksSUB %s %s %d ScreenToClientSession UnlockSetConsoleModeSetFilePointerSetPixelFormatSetThreadTokenSetWindowLongWSetWindowTextWSizeofResourceSleeping for 5SysAllocStringTrackPopupMenuTranslateNameWTypesSupportedVerQueryValueWVirtualProtectVirtualQueryEx[^\w@%+=:,./-]\.+*?()|[]{}^$ Error %d: %s accept-charsetagent-publicipallocfreetracebad allocCountbad record MACbad restart PCbad span statecontent-lengthdata truncatedfile too largefinalizer waitformnovalidategcstoptheworldgetprotobynameinternal errorinvalid optioninvalid pid %vinvalid semverinvalid syntaxis a directorykey size wronglen of type %slevel 2 haltedlevel 3 haltedmultipartfilesneed more datanetwork_confignil elem type!no module datano such devicepacket too bigpowershell.exeprotocol errorread_frame_eofreflect.Selectruntime: full=runtime: want=s.allocCount= script_resultssemaRoot queuestack overflowstopm spinningstore64 failedsync.Cond.Waittext file busytoo many linkstoo many usersunexpected EOFunknown code: unknown error unknown methodunknown mode: unknown node: unknown statusunreachable: unsafe.PointeruserArenaStatewglMakeCurrentwinapi error #work.full != 0zero parameter with GC prog (no semicolon) is unavailable()<>@,;:\"/[]?=,M3.2.0,M11.1.0-NonInteractive0601021504Z0700476837158203125: cannot parse : no frame (sp=<invalid DWORD><invalid QWORD><invalid Value>ASCII_Hex_DigitAccept-EncodingAccept-LanguageAddDllDirectoryCLSIDFromProgIDCLSIDFromStringCallWindowProcWCheckInSyncMeshClientAuthType(Console ConnectCreateHardLinkWCreatePopupMenuCreateWindowExWDefSubclassProcDeviceIoControlDialogBoxParamWDragAcceptFilesDuplicateHandleEnabling RDP...Every other dayFailed to find Failed to load FindNextStreamWFindNextVolumeWFindVolumeCloseFlushViewOfFileGateway TimeoutGdiplusShutdownGetActiveObjectGetActiveWindowGetAdaptersInfoGetClassInfoExWGetCommTimeoutsGetCommandLineWGetEnhMetaFileWGetMenuItemRectGetMonitorInfoWGetProcessTimesGetRawInputDataGetSecurityInfoGetStartupInfoWGetTextMetricsWHEADERS : Hanifi_RohingyaIdempotency-KeyImpersonateSelfInsertMenuItemWInstallLocationIsWindowEnabledIsWindowUnicodeIsWindowVisibleIsWow64Process2Length RequiredMonitorFromRectNTSTATUS 0x%08xNetGetAnyDCNameNetworkSettingsNot ImplementedNot InitializedNtResumeProcessOpenThreadTokenOther_LowercaseOther_UppercasePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512Partial ContentPlayEnhMetaFilePostQuitMessageProcess32FirstWPsalter_PahlaviQueryDosDeviceWQueue InstancesRecovering meshRegCreateKeyExWRegDeleteValueWRequest TimeoutRestartIntervalRtlDefaultNpAclSafeArrayCreateSafeArrayGetDimSafeArrayGetIIDSafeArrayUnlockSameSite=StrictSetCommTimeoutsSetDCBrushColorSetSecurityInfoSetVolumeLabelWShowWindowAsyncStatus: runningStringFromCLSIDStringFromGUID2SwapMouseButtonTactical Agent:The mode to runUninstallStringUnmapViewOfFileWhere to log toX-Forwarded-For] morebuf={pc:accept-encodingaccept-languageadvertise erroragent-agentinfoallocmRInternalapplication/oggapplication/pdfapplication/zipasyncpreemptoffavx512vpopcntdqbad certificatebad trailer keycontenteditabledesktop_monitordouble scavengeelem size wrongfmipv6 messagesfont/collectionforce gc (idle)invalid addressinvalid argSizeinvalid booleaninvalid pointerjstmpllitinterpkey has expiredkilling processmalloc deadlockmisaligned maskmissing addressmissing mcache?monitoring_typems: gomaxprocs=negative offsetnetwork is downnetwork_adapterno dot in fieldno medium foundno such processnon-minimal tagnot implementedpreempt SPWRITErecord overflowrecovery failedrecv_rststream_reflectlite.Setruntime error: runtime: frame runtime: max = runtime: min = runtimer: bad pscan missed a gstartm: m has pstopm holding psync.Mutex.Locktacticalagent-vtacticalrmm.exetarinsecurepathtemplate clausetimeBeginPeriodtimestamp replytraceback stuckunclosed actionunexpected typeunknown Go typeunknown networkunknown versionunknown/invalidwindows-servicewinpty_set_sizewrite error: %wx-forwarded-forzipinsecurepath already; errno= mheap.sweepgen= not in ranges: untyped locals %s %s HTTP/1.1 ()<>@,;:\"/[]?= , not a function--no-config-file-ExecutionPolicy.WithValue(type /api/v3/checkin//etc/resolv.conf0123456789ABCDEF0123456789abcdef2384185791015625: value of type > in name space AdjustWindowRectAllowDemandStartAlready ReportedCheckInAgentInfoCheckInLimitDataCloseEnhMetaFileCoCreateInstanceConnectNamedPipeContent-EncodingContent-LanguageContent-Length: CopyEnhMetaFileWCreateDIBSectionCreateDirectoryWCreateJobObjectWCreateNamedPipeWCreateSolidBrushCryptProtectDataCryptQueryObjectDefineDosDeviceWDelayedAutoStartDispatchMessageWDnsNameCompare_WDuplicateTokenExDwmDefWindowProcDwmRenderGestureDwmTetherContactEnabling ping...EnumChildWindowsEventMessageFileEvery other weekFRAME_SIZE_ERRORFile Not Found: FindFirstStreamWFindFirstVolumeWFlushFileBuffersGC scavenge waitGC worker (idle)GODEBUG: value "GdipDisposeImageGetAsyncKeyStateGetClassLongPtrWGetClipboardDataGetComputerNameWGetConsoleWindowGetCurrentActCtxGetCurrentThreadGetDesktopWindowGetFullPathNameWGetGUIThreadInfoGetKeyboardStateGetLogicalDrivesGetLongPathNameWGetMenuItemCountGetMenuItemInfoWGetModuleHandleWGetNamedPipeInfoGetOpenFileNameWGetPriorityClassGetSaveFileNameWGetSysColorBrushGetSystemMetricsHiberbootEnabledImageList_CreateImageList_RemoveImperial_AramaicInstRuneAnyNotNLIsDialogMessageWMapVirtualKeyExWMeroitic_CursiveMissing new_nameMissing old_nameMonitorFromPointMultiple ChoicesNATS reconnectedNatsPingIntervalNatsStandardPortNetApiBufferFreeNetLocalGroupAddNetLocalGroupDelNtSuspendProcessOpenProcessTokenOther_AlphabeticPayment RequiredProxy-ConnectionRCodeFormatErrorRead after CloseRegQueryInfoKeyWRegQueryValueExWRegisterClassExWRegistrationInfoRemoveDirectoryWRtlGetCurrentPebSETTINGS_TIMEOUTSHA-512-256-sessSafeArrayDestroySeDebugPrivilegeSetClassLongPtrWSetClipboardDataSetDllDirectoryWSetEntriesInAclWSetFilePointerExSetFileValidDataSetMenuItemInfoWSetPriorityClassSetServiceStatusSignatureScheme(System32\cmd.exeTactical RMM v%sTerminateProcessTrackPopupMenuExTranslateMessageUnregisterClassWUpgrade RequiredUse a http proxyUser-Agent: %s VirtualProtectExWWW-AuthenticateWinVerifyTrustExWorkingDirectoryWww-AuthenticateZanabazar_Square runtime stack:

Extracted

Family
  • meshagent

Version
  • 2

Botnet
  • TacticalRMM

C2
  • http://mastiffsystemsmesh.mytrmm.com:443/agent.ashx

Attributes
  • mesh_id

    0x841F73B273680CE972E11DE4D9D860D4133570D0EF3A311AF0D1771A0BBA5B35A9BF1E3D443531CDC25CC082246639BE

  • server_id

    4A595DA5DCFB8F4667B26A40509C81FFD5CC8C6E5173C8B4599AC0EDAD4DE774F0BA8F55C6AA291179B45E62FBE4AD3F

  • wss

    wss://mastiffsystemsmesh.mytrmm.com:443/agent.ashx

Targets

    • Target
      2026-07-12_a761bf8921a9cb4bef1b19206605ef22_cobalt-strike_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_poet-rat_quasar-rat_salatstealer_sliver_snatch
    • Size 5.0MB
    • SHA256 cc54a5630b131da56b8776c879e6d1a36bbb3c3533fa13ea60c2438ca21bf412
    • MD5 SHA1 SHA512 SSDEEP TLSH
    • Detects MeshAgent payload

    • Family: MeshAgent

      MeshAgent is an open source remote access trojan written in C++.

    • Family: Supershell

      Supershell is a cross-platfrom reverse shell written in Golang.

    • Detects executables containing URLs to raw contents of a Github gist

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Sets service image path in registry

      This determines the executable launched when a service starts. It can be used to establish persistence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks