meshagent | 2026-07-28_a2b90cfeee68a133346bf5a36ca2288d_coinminer_glassworm_icedid_njrat_ryuk_sliver

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-28_a2b90cfeee68a133346bf5a36ca2288d_coinminer_glassworm_icedid_njrat_ryuk_sliver
Size 2.8MB
Sample260728-eac4dsxzby
SHA256 0ec1142c61829adc7bda23603e181f6613aa9cdfe13674323d968ef1bb5d8d9e
MD5 a2b90cfeee68a133346bf5a36ca2288d
SHA1 1d90e9cda596e7dfeb1e95f3ebca266c1e21a12a
SHA512 74aa0f318a470aaf63defd92dd94bd79dcf342887d318b630b9a93f2539f9bb82357fa2c5b1eeddb51f5d78cb3a883a303e366752f580b13090f87708b46765c
SSDEEP 49152:fyg9IdIwr80CaBOZofLnjwj7vc7s566RefGUEPccYqMFvfRO7zvqnj:j9b0CBsAOOacYW7Yj
TLSH
T173D58D52A7A800E8D9B7C178CA568517D7F2F8112370ABDF16A54A7A0F236E12F3F711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat trojan backdoor meshagent

Malware Config

Signatures

Family: MeshAgent
MeshAgent is an open source remote access trojan written in C++.
rat trojan backdoor meshagent

Detects MeshAgent payload 1 IoCs

resource	yara_rule
sample	family_meshagent

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-28_a2b90cfeee68a133346bf5a36ca2288d_coinminer_glassworm_icedid_njrat_ryuk_sliver

File Explorer

2026-07-28_a2b90cfeee68a133346bf5a36ca2288d_coinminer_glassworm_icedid_njrat_ryuk_sliver

.exe 2.8MB

2026-07-28_a2b90cfeee68a133346bf5a36ca2288d_coinminer_glassworm_icedid_njrat_ryuk_sliver

IMPHASH a2f26ff77ae5224a10b3e3bce5bf1fd4
SHA256 0ec1142c61829adc7bda23603e181f6613aa9cdfe13674323d968ef1bb5d8d9e
MD5 a2b90cfeee68a133346bf5a36ca2288d
SHA1 1d90e9cda596e7dfeb1e95f3ebca266c1e21a12a
SHA512 74aa0f318a470aaf63defd92dd94bd79dcf342887d318b630b9a93f2539f9bb82357fa2c5b1eeddb51f5d78cb3a883a303e366752f580b13090f87708b46765c
SSDEEP 49152:fyg9IdIwr80CaBOZofLnjwj7vc7s566RefGUEPccYqMFvfRO7zvqnj:j9b0CBsAOOacYW7Yj
TLSH
T173D58D52A7A800E8D9B7C178CA568517D7F2F8112370ABDF16A54A7A0F236E12F3F711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects MeshAgent payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1809932

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\MeshAgent\MeshAgent\Release\MeshService64.pdb

dbghelp

SymFromAddr StackWalk64 SymInitialize SymFunctionTableAccess64 SymGetLineFromAddr64 SymGetModuleBase64 MiniDumpWriteDump

iphlpapi

GetAdaptersAddresses SendARP ConvertLengthToIpv4Mask GetAdaptersInfo

ws2_32

WSAStartup WSACreateEvent WSACloseEvent select htons htonl gethostname ntohs ntohl WSAGetLastError WSASetLastError WSAEventSelect recv send getsockname WSASocketW listen closesocket bind accept __WSAFDIsSet setsockopt socket sendto getsockopt recvfrom connect shutdown WSAResetEvent GetAddrInfoW ioctlsocket WSACleanup FreeAddrInfoW WSAIoctl

crypt32

CertAddEncodedCertificateToStore CryptMsgClose CryptMsgUpdate CryptExportPublicKeyInfo CertCreateSelfSignCertificate CertFreeCertificateContext CryptMsgOpenToEncode CertAddCertificateContextToStore PFXExportCertStore CryptSignAndEncodeCertificate CertCloseStore CertStrToNameA CryptMsgGetParam CryptEncodeObject CertSetCertificateContextProperty CertFindCertificateInStore CryptMsgCalculateEncodedLength CertOpenStore CertStrToNameW CertDeleteCertificateFromStore CertGetCertificateContextProperty CertEnumCertificatesInStore CertDuplicateCertificateContext CryptAcquireCertificatePrivateKey

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueA

gdiplus

GdipLoadImageFromStream GdipSaveImageToStream GdipGetImageEncodersSize GdipFree GdipDisposeImage GdipAlloc GdipCloneImage GdipGetImageEncoders GdiplusShutdown GdiplusStartup

ncrypt

NCryptFinalizeKey BCryptOpenAlgorithmProvider NCryptOpenStorageProvider BCryptGenRandom NCryptSetProperty BCryptCloseAlgorithmProvider NCryptCreatePersistedKey NCryptFreeObject

kernel32

InitializeSListHead GetStartupInfoW RtlUnwindEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetFullPathNameW GetStdHandle WriteFile LoadLibraryExA GetModuleFileNameW GetSystemPowerStatus OpenProcess Sleep GetLastError CloseHandle SetCurrentDirectoryW GetProcAddress CreateProcessW FreeLibrary WideCharToMultiByte WaitForSingleObject GetCurrentThreadId GetModuleHandleA CreateThread QueueUserAPC OpenThread ReadFile GetVersionExA SleepEx SetSystemPowerState GetCurrentProcess SetThreadExecutionState HeapFree HeapAlloc GetProcessHeap SystemTimeToFileTime TlsAlloc FileTimeToSystemTime QueryPerformanceFrequency SystemTimeToTzSpecificLocalTime QueryPerformanceCounter ReleaseSemaphore CreateSemaphoreA CancelIo FindFirstFileW FindNextFileW RemoveDirectoryW GetFinalPathNameByHandleW GetDriveTypeA SetFilePointer FindFirstVolumeA FindClose CreateFileW GetVolumePathNamesForVolumeNameA GetFileAttributesExW ReadDirectoryChangesW FindNextVolumeA FindVolumeClose GetDiskFreeSpaceExA CreateEventA MultiByteToWideChar GetModuleHandleExA LoadLibraryA WaitForMultipleObjectsEx CreateNamedPipeA DisconnectNamedPipe CreateFileA CancelIoEx LocalFree ConnectNamedPipe SetConsoleOutputCP IsDebuggerPresent GetTempPathW CancelSynchronousIo SetEvent IsProcessorFeaturePresent ResetEvent GetCurrentDirectoryW GetThreadId SetEnvironmentVariableA GetCurrentProcessId GetEnvironmentStrings FreeEnvironmentStringsA CopyFileW RtlCaptureContext SuspendThread ResumeThread DuplicateHandle GetCurrentThread GetOverlappedResult GetThreadContext GetTickCount TerminateProcess WTSGetActiveConsoleSessionId GetExitCodeProcess SetEndOfFile DeleteFileW SetFilePointerEx SetConsoleCtrlHandler FreeConsole SetLastError GetFileType GetModuleHandleW EncodePointer SwitchToFiber DeleteFiber CreateFiber GetSystemTimeAsFileTime ConvertFiberToThread ConvertThreadToFiber GetEnvironmentVariableW GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW CreateDirectoryW GetConsoleCP MoveFileExW GetTimeZoneInformation SetStdHandle GetDriveTypeW PeekNamedPipe GetCommandLineA GetCommandLineW GetACP GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetStringTypeW HeapReAlloc FlushFileBuffers WriteConsoleW GetCPInfo FindFirstFileExW IsValidCodePage SetUnhandledExceptionFilter UnhandledExceptionFilter RtlLookupFunctionEntry WaitForSingleObjectEx RtlVirtualUnwind GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW RaiseException HeapSize RtlPcToFileHeader GetSystemTime

user32

GetWindowPlacement ShowWindow SetWindowPlacement SetWindowTextA GetDlgItem EnableWindow MessageBeep ExitWindowsEx GetUserObjectInformationA CloseWindowStation EnumDisplayMonitors GetSystemMetrics SetThreadDesktop GetThreadDesktop CloseDesktop OpenWindowStationA OpenDesktopA GetMonitorInfoA SetProcessWindowStation OpenInputDesktop SendMessageA FindWindowA DialogBoxParamA DispatchMessageA LoadCursorA DestroyWindow GetDC PostMessageA GetIconInfo GetCursorInfo MapVirtualKeyA GetForegroundWindow DefWindowProcA CreateWindowExA TranslateMessage UnregisterClassA DrawIconEx SetWinEventHook RegisterClassExA UnhookWinEvent SetForegroundWindow ReleaseDC SendInput SetProcessDPIAware EndDialog GetProcessWindowStation GetUserObjectInformationW MessageBoxW GetMessageA

gdi32

DeleteObject BitBlt StretchBlt DeleteDC SetStretchBltMode CreateCompatibleBitmap SelectObject CreateCompatibleDC GetDIBits GetObjectA

advapi32

QueryServiceStatus CryptGetUserKey CryptSetHashParam CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey RegDeleteValueA RegOpenKeyExA RegSetValueExA RegQueryValueExA RegDeleteKeyA RegCloseKey RegCreateKeyA OpenProcessToken InitiateSystemShutdownA LookupPrivilegeValueA AdjustTokenPrivileges CryptReleaseContext RegCreateKeyW RegSetValueExW CryptDestroyKey InitializeSecurityDescriptor SetEntriesInAclA SetSecurityDescriptorDacl DuplicateTokenEx CreateProcessAsUserW SetTokenInformation OpenServiceA CheckTokenMembership FreeSid StartServiceA ControlService RegisterServiceCtrlHandlerExA OpenSCManagerA SetServiceStatus AllocateAndInitializeSid CloseServiceHandle CryptAcquireContextW StartServiceCtrlDispatcherA DeregisterEventSource RegisterEventSourceW ReportEventW CryptGetProvParam

shell32

ShellExecuteExW

ole32

CoUninitialize CoInitializeEx CoCreateInstance CreateStreamOnHGlobal

oleaut32

SysFreeString SysStringLen SysAllocString

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

769KB

Virtual Size

768KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_a2b90cfeee68a133346bf5a36ca2288d_coinminer_glassworm_icedid_njrat_ryuk_sliver

dbghelp

iphlpapi

ws2_32

crypt32

version

gdiplus

ncrypt

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

generic