meshagent | 2026-07-22_48c935820975dd00b62717de96d9012b_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_48c935820975dd00b62717de96d9012b_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc
Size 5.5MB
Sample260722-ye478atclf
SHA256 58081c42d9fafb3d3afb9d73937a4f3bdaaff2fb0b699234eb84dc52db771e2e
MD5 48c935820975dd00b62717de96d9012b
SHA1 b07a104e2b861d7d758e4452e02af78ab3f03fb8
SHA512 a1d86c5376081e71389c9bd13c1a0dcd079d31941643a6e56d40bebb46373dee4eb09ab70f9555c8f1a6013a50c6419854cde019d6b9a31cfb6acfa8b65709a7
SSDEEP 49152:9FowL0p9cDDW0qECwa5RitriRyxEPwrVsIskNypf9e84WvcqZMUE5/9KWGmvy/GW:jL+2Hc7YRW9MNcya3ccyy
TLSH
T191467D83FAAA00E4D4BBE13455A26127F975F452033497DBD2546A6F0F32FE0AA3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

testing purpose only rat trojan backdoor meshagent

Malware Config

Extracted

Family

meshagent

Version

Botnet

Testing Purpose Only

http://bullsseo.com:443/agent.ashx

Attributes

mesh_id
0x4B20F67211C20CD07E5E53285D1203059159DFF0AC668E10C1DB29007651D5C3BCD6FB31D9DA6E7C120C9F21DAC980BF
server_id
460435B76E2BA7A386C796547EE9B205E12F241B5E68453D37FB6DC55D7215361C5860C69962327ED15D48ACFF0C8280
wss
wss://bullsseo.com:443/agent.ashx

Signatures

Family: MeshAgent
MeshAgent is an open source remote access trojan written in C++.
rat trojan backdoor meshagent

Detects MeshAgent payload 1 IoCs

resource	yara_rule
sample	family_meshagent

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_48c935820975dd00b62717de96d9012b_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-07-22_48c935820975dd00b62717de96d9012b_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc

.exe 5.5MB

2026-07-22_48c935820975dd00b62717de96d9012b_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH b76ae5b600863303e5a3adc79dfd7e41
SHA256 58081c42d9fafb3d3afb9d73937a4f3bdaaff2fb0b699234eb84dc52db771e2e
MD5 48c935820975dd00b62717de96d9012b
SHA1 b07a104e2b861d7d758e4452e02af78ab3f03fb8
SHA512 a1d86c5376081e71389c9bd13c1a0dcd079d31941643a6e56d40bebb46373dee4eb09ab70f9555c8f1a6013a50c6419854cde019d6b9a31cfb6acfa8b65709a7
SSDEEP 49152:9FowL0p9cDDW0qECwa5RitriRyxEPwrVsIskNypf9e84WvcqZMUE5/9KWGmvy/GW:jL+2Hc7YRW9MNcya3ccyy
TLSH
T191467D83FAAA00E4D4BBE13455A26127F975F452033497DBD2546A6F0F32FE0AA3E741
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects MeshAgent payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2850912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Admin\Desktop\cbtmesh inclusive inject\Release-NoLogs\MeshService64.pdb

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

comctl32

InitCommonControlsEx

dbghelp

SymFromAddr MiniDumpWriteDump SymGetModuleBase64 SymGetLineFromAddr64 SymFunctionTableAccess64 StackWalk64 SymInitialize

iphlpapi

ConvertLengthToIpv4Mask SendARP GetAdaptersAddresses GetAdaptersInfo

ws2_32

htons htonl gethostname ntohs ntohl WSAGetLastError ioctlsocket recv send getsockname FreeAddrInfoW WSASocketW listen closesocket bind accept __WSAFDIsSet setsockopt socket WSASetLastError sendto getsockopt recvfrom connect shutdown WSAIoctl GetAddrInfoW WSAResetEvent WSAEventSelect WSAStartup WSACreateEvent WSACloseEvent select WSACleanup freeaddrinfo getaddrinfo

crypt32

CertDuplicateCertificateContext CertStrToNameW CertEnumCertificatesInStore CertGetCertificateContextProperty CertOpenStore CryptMsgCalculateEncodedLength CertDeleteCertificateFromStore CryptAcquireCertificatePrivateKey CertAddEncodedCertificateToStore CryptMsgClose CryptMsgUpdate CryptExportPublicKeyInfo CertCreateSelfSignCertificate CertFreeCertificateContext CryptMsgOpenToEncode CertAddCertificateContextToStore PFXExportCertStore CryptSignAndEncodeCertificate CertCloseStore CertStrToNameA CryptMsgGetParam CryptEncodeObject CertSetCertificateContextProperty CertFindCertificateInStore

wtsapi32

WTSQueryUserToken

gdiplus

GdiplusStartup GdipGetImageEncoders GdipCloneImage GdipDisposeImage GdipLoadImageFromStreamICM GdipAlloc GdiplusShutdown GdipFree GdipGetImageEncodersSize GdipSaveImageToStream GdipLoadImageFromStream

ncrypt

NCryptCreatePersistedKey NCryptFinalizeKey BCryptOpenAlgorithmProvider NCryptOpenStorageProvider BCryptGenRandom BCryptCloseAlgorithmProvider NCryptSetProperty NCryptFreeObject

shlwapi

PathFileExistsA

dwmapi

DwmSetWindowAttribute

kernel32

DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader RaiseException FlsAlloc GetFullPathNameW GetStdHandle WriteFile LoadLibraryExA GetModuleFileNameW GetSystemPowerStatus OpenProcess MultiByteToWideChar Sleep GetLastError CloseHandle GetCurrentDirectoryW SetCurrentDirectoryW GetProcAddress SetEnvironmentVariableA CreateProcessW FreeLibrary WideCharToMultiByte GetCurrentThreadId GetModuleHandleA WaitForSingleObjectEx CreateThread QueueUserAPC OpenThread ReadFile Process32First TerminateProcess CreateToolhelp32Snapshot LoadLibraryA Process32Next SleepEx SetSystemPowerState GetCurrentProcess SetThreadExecutionState HeapFree HeapAlloc GetProcessHeap SystemTimeToFileTime GetSystemTime FileTimeToSystemTime QueryPerformanceFrequency FlsGetValue QueryPerformanceCounter ReleaseSemaphore WaitForSingleObject CreateSemaphoreA CancelIo FindFirstFileW FindNextFileW RemoveDirectoryW GetFinalPathNameByHandleW GetDriveTypeA SetFilePointer FindFirstVolumeA FindClose CreateFileW GetVolumePathNamesForVolumeNameA GetFileAttributesExW ReadDirectoryChangesW FindNextVolumeA FindVolumeClose GetDiskFreeSpaceExA CreateEventA GetModuleHandleExA WaitForMultipleObjectsEx CreateNamedPipeA DisconnectNamedPipe CreateFileA CancelIoEx LocalFree ConnectNamedPipe SetConsoleMode GetConsoleMode SetConsoleOutputCP IsDebuggerPresent GetTempPathW CancelSynchronousIo SetEvent ResetEvent GetThreadId GetCurrentProcessId InitializeCriticalSectionEx FreeEnvironmentStringsA CopyFileW RtlCaptureContext SuspendThread ResumeThread DuplicateHandle ExitThread GetTickCount64 GetCurrentThread DeleteFileA GetOverlappedResult GetThreadContext WTSGetActiveConsoleSessionId GetExitCodeProcess SetEndOfFile DeleteFileW SetFilePointerEx WriteProcessMemory SetLastError EnterCriticalSection Module32Next LeaveCriticalSection InitializeCriticalSection Module32First K32GetModuleFileNameExA GetFileAttributesA GetSystemDirectoryA VirtualAllocEx DeleteCriticalSection CreateRemoteThread CreateProcessA VirtualFreeEx GetTickCount IsWow64Process GetModuleFileNameA SizeofResource FindResourceA OpenEventW LockResource GetWindowsDirectoryA LoadResource SetConsoleCtrlHandler GetFileSizeEx OutputDebugStringA CreateMutexW CreateMutexA HeapSize GetTempPathA FreeConsole GetWindowsDirectoryW ExitProcess GetConsoleWindow GetFileType LoadLibraryExW GetModuleHandleW SwitchToFiber DeleteFiber CreateFiber GetSystemTimeAsFileTime ConvertFiberToThread ConvertThreadToFiber GetEnvironmentVariableW ReadConsoleA ReadConsoleW FlsSetValue FlsFree RtlUnwind GetModuleHandleExW RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent CreateDirectoryW GetConsoleOutputCP MoveFileExW SetEnvironmentVariableW GetTimeZoneInformation SetStdHandle FreeLibraryAndExitThread GetDriveTypeW GetFileInformationByHandle PeekNamedPipe GetCommandLineA GetCommandLineW VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW EncodePointer InitializeSListHead GetStartupInfoW GetEnvironmentStrings SetUnhandledExceptionFilter HeapReAlloc FlushFileBuffers FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW SystemTimeToTzSpecificLocalTime CreateEventW

user32

GetClientRect GetUserObjectInformationW SendMessageA MessageBoxA SetWindowDisplayAffinity RegisterClassW SetTimer GetDlgItemTextA ShowWindow DialogBoxParamA EndDialog CreateWindowExW SetWindowPos GetWindowRect GetProcessWindowStation MessageBoxW PtInRect UpdateWindow InvalidateRect GetWindowThreadProcessId FindWindowExA GetWindowLongA GetWindowDisplayAffinity MessageBeep ExitWindowsEx DrawTextW UpdateLayeredWindow GetSystemMetrics SetThreadDesktop GetThreadDesktop CloseDesktop BlockInput GetMonitorInfoA OpenInputDesktop GetKeyState GetMessageA GetMessageExtraInfo DispatchMessageA LoadCursorA DestroyWindow GetDC PostMessageA GetIconInfo CallNextHookEx GetCursorInfo SetWindowsHookExA MapVirtualKeyA GetForegroundWindow UnhookWindowsHookEx DefWindowProcA CreateWindowExA TranslateMessage UnregisterClassA DrawIconEx SetWinEventHook RegisterClassExA UnhookWinEvent SetForegroundWindow ReleaseDC SendInput SetProcessDPIAware KillTimer PostQuitMessage EnumDisplayMonitors GetWindowLongPtrA SetWindowLongPtrA GetUserObjectInformationA

gdi32

CreateFontW CreateDIBSection DeleteObject GetPixel SetTextColor SetBkMode BitBlt StretchBlt DeleteDC SetStretchBltMode CreateCompatibleBitmap SelectObject CreateCompatibleDC GetDIBits GetObjectA

advapi32

SetServiceStatus DeregisterEventSource StartServiceCtrlDispatcherA AllocateAndInitializeSid CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptAcquireContextW ReportEventW RegisterServiceCtrlHandlerExA RegCreateKeyW RegSetValueExA RegDeleteKeyA RegCloseKey RegOpenKeyExA OpenProcessToken InitiateSystemShutdownA LookupPrivilegeValueA AdjustTokenPrivileges CryptReleaseContext RegSetValueExW CryptDestroyKey InitializeSecurityDescriptor SetEntriesInAclA SetSecurityDescriptorDacl DuplicateTokenEx CreateProcessAsUserW SetTokenInformation CreateProcessAsUserA CheckTokenMembership FreeSid RegisterEventSourceW

shell32

ShellExecuteExW

ole32

CoInitializeEx CoTaskMemFree CoCreateInstance CreateStreamOnHGlobal CoUninitialize

Name

.text

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

615KB

Virtual Size

614KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

615KB

Virtual Size

777KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2026-07-22_48c935820975dd00b62717de96d9012b_amadey_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_satacom_stealc

userenv

comctl32

dbghelp

iphlpapi

ws2_32

crypt32

wtsapi32

gdiplus

ncrypt

shlwapi

dwmapi

kernel32

user32

gdi32

advapi32

shell32

ole32

generic