meshagent | 2026-08-18_2ded5c802f2e0b7593bc6965d31ceb57_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_ransomhub_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-18_2ded5c802f2e0b7593bc6965d31ceb57_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_ransomhub_satacom_stealc
Size 5.6MB
Sample260818-wye2bsaf89
SHA256 45a0b007ee3666b2885bf9d6b301b53e58936aa6d0ec6b00f8370f6a3374521d
MD5 2ded5c802f2e0b7593bc6965d31ceb57
SHA1 08fead1400c5f532b09a1357e5dd448c8bd35b27
SHA512 202247fa93dbdcaf9f9be92ad601c22f0d8cebbb8e27bd5f7a553bfd4a2d95cfc0665b42a85486a9790c3b26981ef12c676a078bcd4f4ddfab5496b7be2e9e54
SSDEEP 49152:u3Molg5kJad3uykWI0J0b1V+u/UpXAyR1rxEj/lYxrAXBmCL/8dKSvcqZZWg5+Vp:/oUDkBHCmxRmCL/GtKAfwgkAfO
TLSH
T130467D83FBBA40E4D4BBE13855A26127F975B412033497DBD2546A6E0F32FD0AA3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

vue4exam rat trojan backdoor meshagent

Malware Config

Extracted

Family

meshagent

Version

Botnet

Vue4exam

http://awsvoucher.com:443/agent.ashx

Attributes

mesh_id
0x0F3ECD613895027914E3966633942BEFC309979D4F5197D5707EBE487BFC128081A105E934C70F0FDD6B78A50045F097
server_id
460435B76E2BA7A386C796547EE9B205E12F241B5E68453D37FB6DC55D7215361C5860C69962327ED15D48ACFF0C8280
wss
wss://awsvoucher.com:443/agent.ashx

Signatures

Family: MeshAgent
MeshAgent is an open source remote access trojan written in C++.
rat trojan backdoor meshagent

Detects MeshAgent payload 1 IoCs

resource	yara_rule
sample	family_meshagent

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-18_2ded5c802f2e0b7593bc6965d31ceb57_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_ransomhub_satacom_stealc

File Explorer

2026-08-18_2ded5c802f2e0b7593bc6965d31ceb57_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_ransomhub_satacom_stealc

.exe 5.6MB

2026-08-18_2ded5c802f2e0b7593bc6965d31ceb57_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_ransomhub_satacom_stealc

IMPHASH 8136b38e2a1d54925947ca53f5533ba7
SHA256 45a0b007ee3666b2885bf9d6b301b53e58936aa6d0ec6b00f8370f6a3374521d
MD5 2ded5c802f2e0b7593bc6965d31ceb57
SHA1 08fead1400c5f532b09a1357e5dd448c8bd35b27
SHA512 202247fa93dbdcaf9f9be92ad601c22f0d8cebbb8e27bd5f7a553bfd4a2d95cfc0665b42a85486a9790c3b26981ef12c676a078bcd4f4ddfab5496b7be2e9e54
SSDEEP 49152:u3Molg5kJad3uykWI0J0b1V+u/UpXAyR1rxEj/lYxrAXBmCL/8dKSvcqZZWg5+Vp:/oUDkBHCmxRmCL/GtKAfwgkAfO
TLSH
T130467D83FBBA40E4D4BBE13855A26127F975B412033497DBD2546A6E0F32FD0AA3E741
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects MeshAgent payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2864896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\shubham\OneDrive\Desktop\inclusive-cbtmesh-1\Release-NoLogs\MeshService64.pdb

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

comctl32

InitCommonControlsEx

dbghelp

SymFunctionTableAccess64 SymGetLineFromAddr64 SymGetModuleBase64 MiniDumpWriteDump SymFromAddr SymInitialize StackWalk64

iphlpapi

ConvertLengthToIpv4Mask SendARP GetAdaptersAddresses GetAdaptersInfo

ws2_32

WSAGetLastError ntohl ntohs gethostname htonl htons WSAResetEvent ioctlsocket recv send getsockname WSASocketW bind WSAEventSelect WSAStartup WSACreateEvent WSACloseEvent listen closesocket select GetAddrInfoW WSASetLastError accept __WSAFDIsSet setsockopt socket sendto getsockopt recvfrom connect shutdown FreeAddrInfoW WSACleanup freeaddrinfo getaddrinfo WSAIoctl

crypt32

CertGetCertificateContextProperty CertDuplicateCertificateContext CertEnumCertificatesInStore CertStrToNameW CertDeleteCertificateFromStore CryptAcquireCertificatePrivateKey CertAddEncodedCertificateToStore CryptMsgClose CryptMsgUpdate CryptExportPublicKeyInfo CertCreateSelfSignCertificate CertFreeCertificateContext CryptMsgOpenToEncode CertAddCertificateContextToStore PFXExportCertStore CryptSignAndEncodeCertificate CertCloseStore CertStrToNameA CryptMsgGetParam CertOpenStore CertSetCertificateContextProperty CertFindCertificateInStore CryptMsgCalculateEncodedLength CryptEncodeObject

wtsapi32

WTSQueryUserToken WTSFreeMemory WTSEnumerateSessionsW

gdiplus

GdipFree GdipLoadImageFromStreamICM GdipDisposeImage GdipGetImageEncodersSize GdipCloneImage GdipGetImageEncoders GdiplusShutdown GdipSaveImageToStream GdipAlloc GdiplusStartup GdipLoadImageFromStream

winhttp

WinHttpCrackUrl WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse

ncrypt

NCryptFreeObject BCryptGenRandom NCryptCreatePersistedKey BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash NCryptOpenStorageProvider BCryptCreateHash NCryptSetProperty NCryptFinalizeKey BCryptHashData

shlwapi

PathFileExistsA StrStrIA

dwmapi

DwmSetWindowAttribute

kernel32

DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader RaiseException FlsAlloc FlsGetValue FlsSetValue FlsFree RtlUnwind GetModuleHandleExW RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent CreateDirectoryW GetConsoleOutputCP GetFullPathNameW GetStdHandle WriteFile LoadLibraryExA GetModuleFileNameW GetSystemPowerStatus OpenProcess MultiByteToWideChar Sleep GetLastError CloseHandle GetCurrentDirectoryW SetCurrentDirectoryW GetProcAddress SetEnvironmentVariableA CreateProcessW FreeLibrary WideCharToMultiByte ReadFile GetCurrentProcess ExpandEnvironmentStringsW SetFileTime CreateFileW GetFileAttributesW CreateToolhelp32Snapshot Process32NextW DeleteFileW Process32FirstW CreateThread GetWindowsDirectoryW LocalFree MoveFileExW CopyFileW SetEnvironmentVariableW GetFileTime GetCurrentThreadId GetModuleHandleA WaitForSingleObjectEx QueueUserAPC OpenThread Process32First TerminateProcess LoadLibraryA Process32Next SleepEx SetSystemPowerState SetThreadExecutionState HeapFree HeapAlloc GetProcessHeap SystemTimeToFileTime GetSystemTime FileTimeToSystemTime QueryPerformanceFrequency SystemTimeToTzSpecificLocalTime QueryPerformanceCounter ReleaseSemaphore WaitForSingleObject CreateSemaphoreA CancelIo FindFirstFileW FindNextFileW RemoveDirectoryW GetFinalPathNameByHandleW GetDriveTypeA SetFilePointer FindFirstVolumeA FindClose GetVolumePathNamesForVolumeNameA GetFileAttributesExW ReadDirectoryChangesW FindNextVolumeA FindVolumeClose GetDiskFreeSpaceExA CreateEventA InitializeCriticalSectionEx WaitForMultipleObjectsEx CreateNamedPipeA DisconnectNamedPipe CreateFileA CancelIoEx ConnectNamedPipe SetConsoleMode GetConsoleMode SetConsoleOutputCP IsDebuggerPresent GetTempPathW CancelSynchronousIo SetEvent ResetEvent GetThreadId GetCurrentProcessId GetEnvironmentStrings FreeEnvironmentStringsA RtlCaptureContext SuspendThread ResumeThread DuplicateHandle ExitThread GetTickCount64 GetCurrentThread DeleteFileA GetOverlappedResult GetThreadContext WTSGetActiveConsoleSessionId GetExitCodeProcess SetEndOfFile SetFilePointerEx WriteProcessMemory SetLastError EnterCriticalSection Module32Next LeaveCriticalSection InitializeCriticalSection Module32First K32GetModuleFileNameExA GetFileAttributesA GetSystemDirectoryA VirtualAllocEx DeleteCriticalSection ReadProcessMemory CreateRemoteThread CreateProcessA VirtualFreeEx IsWow64Process GetModuleFileNameA SizeofResource HeapSize OpenEventW LockResource GetWindowsDirectoryA LoadResource SetConsoleCtrlHandler GetFileSizeEx OutputDebugStringA CreateMutexW CreateMutexA CreateEventW GetTempPathA FreeConsole ExitProcess GetConsoleWindow GetFileType LoadLibraryExW GetModuleHandleW SwitchToFiber DeleteFiber CreateFiber GetSystemTimeAsFileTime ConvertFiberToThread ConvertThreadToFiber GetEnvironmentVariableW ReadConsoleA ReadConsoleW GetTimeZoneInformation SetStdHandle FreeLibraryAndExitThread GetDriveTypeW GetFileInformationByHandle PeekNamedPipe GetCommandLineA GetCommandLineW VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW EncodePointer InitializeSListHead GetStartupInfoW GetModuleHandleExA SetUnhandledExceptionFilter HeapReAlloc FlushFileBuffers FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW GetTickCount FindResourceA

user32

PtInRect SetWindowLongPtrA PostQuitMessage KillTimer DrawTextW GetWindowLongPtrA UpdateLayeredWindow GetClientRect GetUserObjectInformationW SendMessageA MessageBoxA SetWindowDisplayAffinity RegisterClassW SetTimer GetDlgItemTextA ShowWindow DialogBoxParamA EndDialog CreateWindowExW SetWindowPos GetWindowRect GetProcessWindowStation MessageBoxW FindWindowExA EnumDisplayMonitors InvalidateRect SetThreadDesktop GetThreadDesktop CloseDesktop BlockInput GetMonitorInfoA OpenInputDesktop GetKeyState GetMessageA GetMessageExtraInfo DispatchMessageA LoadCursorA DestroyWindow GetDC PostMessageA GetIconInfo CallNextHookEx GetCursorInfo SetWindowsHookExA MapVirtualKeyA GetForegroundWindow UnhookWindowsHookEx DefWindowProcA CreateWindowExA TranslateMessage UnregisterClassA DrawIconEx SetWinEventHook RegisterClassExA UnhookWinEvent SetForegroundWindow ReleaseDC SendInput SetProcessDPIAware GetWindowLongA GetWindowDisplayAffinity MessageBeep UpdateWindow GetSystemMetrics ExitWindowsEx GetWindowThreadProcessId GetUserObjectInformationA

gdi32

SetBkMode BitBlt StretchBlt DeleteDC SetStretchBltMode CreateCompatibleBitmap SelectObject SetTextColor GetPixel CreateCompatibleDC GetDIBits CreateFontW CreateDIBSection DeleteObject GetObjectA

advapi32

RegisterServiceCtrlHandlerExA CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource StartServiceCtrlDispatcherA AllocateAndInitializeSid SetServiceStatus RegCreateKeyW RegSetValueExA RegDeleteKeyA RegCloseKey GetTokenInformation RegQueryValueExW RegOpenKeyExW OpenProcessToken ConvertSidToStringSidA RegOpenKeyExA InitiateSystemShutdownA LookupPrivilegeValueA AdjustTokenPrivileges CryptReleaseContext RegSetValueExW CryptDestroyKey CryptEnumProvidersW InitializeSecurityDescriptor SetEntriesInAclA SetSecurityDescriptorDacl DuplicateTokenEx CreateProcessAsUserW SetTokenInformation CreateProcessAsUserA CheckTokenMembership FreeSid

shell32

ShellExecuteExW

ole32

CoInitializeEx CoTaskMemFree CoCreateInstance CreateStreamOnHGlobal CoUninitialize

Name

.text

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

619KB

Virtual Size

618KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

621KB

Virtual Size

783KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

129KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2026-08-18_2ded5c802f2e0b7593bc6965d31ceb57_cobalt-strike_coinminer_glassworm_icedid_luca-stealer_njrat_ransomhub_satacom_stealc

userenv

comctl32

dbghelp

iphlpapi

ws2_32

crypt32

wtsapi32

gdiplus

winhttp

ncrypt

shlwapi

dwmapi

kernel32

user32

gdi32

advapi32

shell32

ole32

generic