meshagent | 2026-08-06_6567d0a98196c1f006c42b49928e7c5f_coinminer_glassworm_icedid_njrat_ransomhub_ryuk_sliver

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-06_6567d0a98196c1f006c42b49928e7c5f_coinminer_glassworm_icedid_njrat_ransomhub_ryuk_sliver
Size 2.9MB
Sample260806-vre73swere
SHA256 5bc50120ecb8ecf9c743ffc5a3d5992cd35926963489d96c93fcc9ba2fb39254
MD5 6567d0a98196c1f006c42b49928e7c5f
SHA1 a1c92f68dc480a7a7a234ff5adcb4aafab5e643c
SHA512 990fdcbda705b4c0acabf79c3baa087c19f2b50ccb66987e5c97600c5c4933aa3bb10056b667e3a3ea77b0a74e32ca0c2721db80a97a1439a920aae6c8265a3e
SSDEEP 49152:hzrLHIF6MUVL0lSmaPWzltvqnNcum/WD6KVzx8T/Gwuc1Fg9MFvf+KYoQ+DH:970wmbHnKxwDFgOYkDH
TLSH
T135E56B42AF990CE4C776C13885DD41D7D6BDBB151372ABCF06A48A6A0F276E11AFE301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat trojan backdoor meshagent

Malware Config

Signatures

Family: MeshAgent
MeshAgent is an open source remote access trojan written in C++.
rat trojan backdoor meshagent

Detects MeshAgent payload 1 IoCs

resource	yara_rule
sample	family_meshagent

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-06_6567d0a98196c1f006c42b49928e7c5f_coinminer_glassworm_icedid_njrat_ransomhub_ryuk_sliver

File Explorer

2026-08-06_6567d0a98196c1f006c42b49928e7c5f_coinminer_glassworm_icedid_njrat_ransomhub_ryuk_sliver

.exe 2.9MB

2026-08-06_6567d0a98196c1f006c42b49928e7c5f_coinminer_glassworm_icedid_njrat_ransomhub_ryuk_sliver

IMPHASH b149b2ae2b342863795fdc77cf271dae
SHA256 5bc50120ecb8ecf9c743ffc5a3d5992cd35926963489d96c93fcc9ba2fb39254
MD5 6567d0a98196c1f006c42b49928e7c5f
SHA1 a1c92f68dc480a7a7a234ff5adcb4aafab5e643c
SHA512 990fdcbda705b4c0acabf79c3baa087c19f2b50ccb66987e5c97600c5c4933aa3bb10056b667e3a3ea77b0a74e32ca0c2721db80a97a1439a920aae6c8265a3e
SSDEEP 49152:hzrLHIF6MUVL0lSmaPWzltvqnNcum/WD6KVzx8T/Gwuc1Fg9MFvf+KYoQ+DH:970wmbHnKxwDFgOYkDH
TLSH
T135E56B42AF990CE4C776C13885DD41D7D6BDBB151372ABCF06A48A6A0F276E11AFE301
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects MeshAgent payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1729100

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\tmp\MeshAgent\Release\MeshService64.pdb

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailA SetupDiGetClassDevsA SetupDiEnumDeviceInterfaces

dbghelp

MiniDumpWriteDump SymGetLineFromAddr64 SymFunctionTableAccess64 SymInitialize StackWalk64 SymFromAddr SymGetModuleBase64

iphlpapi

GetAdaptersAddresses SendARP ConvertLengthToIpv4Mask GetAdaptersInfo

ws2_32

send getsockname WSASocketW listen closesocket bind accept __WSAFDIsSet setsockopt socket recv WSASetLastError getsockopt recvfrom connect shutdown WSAIoctl GetAddrInfoW ioctlsocket WSAGetLastError ntohl ntohs gethostname htonl htons sendto WSAStartup WSACleanup FreeAddrInfoW select

crypt32

CryptMsgUpdate CryptExportPublicKeyInfo CertCreateSelfSignCertificate CertFreeCertificateContext CryptMsgOpenToEncode CertAddCertificateContextToStore PFXExportCertStore CryptSignAndEncodeCertificate CertCloseStore CertStrToNameA CryptMsgGetParam CryptEncodeObject CertSetCertificateContextProperty CertFindCertificateInStore CryptMsgCalculateEncodedLength CertOpenStore CertStrToNameW CryptMsgClose CertAddEncodedCertificateToStore CryptAcquireCertificatePrivateKey CertDeleteCertificateFromStore CertEnumCertificatesInStore CertDuplicateCertificateContext CertGetCertificateContextProperty

wintrust

WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain WTHelperGetProvCertFromChain WinVerifyTrust

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

gdiplus

GdipCloneImage GdipSaveImageToStream GdipGetImageEncodersSize GdipFree GdipDisposeImage GdiplusStartup GdiplusShutdown GdipGetImageEncoders GdipLoadImageFromStream GdipAlloc

winhttp

WinHttpGetIEProxyConfigForCurrentUser

ncrypt

BCryptOpenAlgorithmProvider NCryptOpenStorageProvider NCryptFreeObject NCryptFinalizeKey NCryptSetProperty BCryptCloseAlgorithmProvider NCryptCreatePersistedKey BCryptGenRandom

kernel32

InitializeSListHead GetStartupInfoW RtlUnwindEx LoadLibraryExW ExitProcess CreateDirectoryW DeleteFileW MoveFileExW GetTimeZoneInformation SetStdHandle GetDriveTypeW PeekNamedPipe GetModuleFileNameA GetStdHandle WriteFile LoadLibraryExA GetFullPathNameA GetSystemPowerStatus SetCurrentDirectoryA Sleep GetLastError CloseHandle GetProcAddress FreeLibrary WideCharToMultiByte CreateProcessA LoadLibraryA ReadFile GetCurrentThreadId GetVersionExA CreateThread SleepEx SetSystemPowerState GetCurrentProcess SetThreadExecutionState HeapFree HeapAlloc GetProcessHeap SystemTimeToFileTime GetCommandLineA FileTimeToSystemTime QueryPerformanceFrequency SystemTimeToTzSpecificLocalTime QueryPerformanceCounter SetEvent WaitForSingleObjectEx CreateEventA ReleaseSemaphore WaitForSingleObject CreateSemaphoreA CancelIo FindFirstFileW FindNextFileW RemoveDirectoryW GetDriveTypeA FindFirstVolumeA FindClose GetVolumePathNamesForVolumeNameA GetFileAttributesExW CreateFileA ReadDirectoryChangesW FindNextVolumeA FindVolumeClose GetDiskFreeSpaceExA MultiByteToWideChar GetModuleHandleExA DeviceIoControl ResetEvent QueueUserAPC GetOverlappedResult CreateNamedPipeA LocalFree ConnectNamedPipe SetConsoleOutputCP IsDebuggerPresent GetCurrentDirectoryA CancelSynchronousIo IsProcessorFeaturePresent SetEnvironmentVariableA GetCurrentProcessId GetEnvironmentStrings FreeEnvironmentStringsA CopyFileA RtlCaptureContext CreateFileW SuspendThread ResumeThread DuplicateHandle GetModuleHandleA GetCurrentThread DeleteFileA GetThreadContext GetTickCount OpenThread TerminateProcess WriteFileEx WaitForMultipleObjectsEx ReadFileEx CancelIoEx WTSGetActiveConsoleSessionId GetExitCodeProcess SetConsoleCtrlHandler GetModuleFileNameW GetTempPathA GlobalFree FreeConsole EncodePointer CreateDirectoryA SetLastError GetModuleHandleExW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree GetFileType GetModuleHandleW SwitchToFiber DeleteFiber CreateFiber GetSystemTimeAsFileTime ConvertFiberToThread ConvertThreadToFiber LoadLibraryW GetEnvironmentVariableW GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode GetCommandLineW GetACP GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW SetFilePointerEx GetConsoleCP GetStringTypeW HeapReAlloc FlushFileBuffers GetCPInfo GetCurrentDirectoryW GetFullPathNameW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind GetThreadId RtlLookupFunctionEntry FindFirstFileExW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW RaiseException HeapSize SetEndOfFile RtlPcToFileHeader GetSystemTime RemoveDirectoryA

user32

MessageBeep ExitWindowsEx GetUserObjectInformationA CloseWindowStation EnumDisplayMonitors GetSystemMetrics SetThreadDesktop GetThreadDesktop CloseDesktop OpenWindowStationA OpenDesktopA GetMonitorInfoA SetProcessWindowStation EnableWindow SendMessageA FindWindowA LoadCursorA GetDC GetIconInfo GetCursorInfo MapVirtualKeyA GetForegroundWindow DrawIconEx SetForegroundWindow ReleaseDC SendInput SetProcessDPIAware GetDlgItem SetWindowTextA SetWindowPlacement ShowWindow GetWindowPlacement DialogBoxParamA EndDialog GetProcessWindowStation GetUserObjectInformationW MessageBoxW OpenInputDesktop

gdi32

StretchBlt DeleteDC SetStretchBltMode DeleteObject CreateCompatibleBitmap BitBlt GetObjectA SelectObject CreateCompatibleDC GetDIBits

advapi32

CloseServiceHandle CryptEnumProvidersW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam RegDeleteValueA RegOpenKeyExA RegSetValueExA RegQueryValueExA RegDeleteKeyA RegCloseKey RegCreateKeyA OpenProcessToken InitiateSystemShutdownA LookupPrivilegeValueA AdjustTokenPrivileges CryptReleaseContext RegCreateKeyW RegSetValueExW CryptDestroyKey InitializeSecurityDescriptor SetEntriesInAclA SetSecurityDescriptorDacl DuplicateTokenEx SetTokenInformation CreateProcessAsUserA OpenServiceA ChangeServiceConfig2A CheckTokenMembership FreeSid StartServiceA ControlService DeleteService CryptAcquireContextW RegisterServiceCtrlHandlerExA OpenSCManagerA SetServiceStatus AllocateAndInitializeSid CryptSignHashW QueryServiceStatus StartServiceCtrlDispatcherA ReportEventW RegisterEventSourceW DeregisterEventSource CreateServiceA

shell32

SHGetFolderPathA ShellExecuteExA

ole32

CoUninitialize CoCreateInstance CreateStreamOnHGlobal CoInitializeEx

oleaut32

SysAllocString SysStringLen SysFreeString

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

986KB

Virtual Size

986KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

97KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_6567d0a98196c1f006c42b49928e7c5f_coinminer_glassworm_icedid_njrat_ransomhub_ryuk_sliver

setupapi

dbghelp

iphlpapi

ws2_32

crypt32

wintrust

version

gdiplus

winhttp

ncrypt

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

generic