General
- Target 2026-08-23_5467c18ea22ef8f3d83412babc2ff57a_coinminer_glassworm_hijackloader_icedid_njrat_ransomhub_ryuk_sliver
- Size 3.3MB
- Sample260824-nvanfasxey
- SHA256 fb19a64b802fe51a4b990f4c98136bffe7490188610b7c7251c84cb6ef7270fb
- MD5 5467c18ea22ef8f3d83412babc2ff57a
- SHA1 6d0ed3bf8b2d8b53189b7f1784a75e1ae7658036
- SHA512 1ef512aaa04c16d27aaf26addc435a834f6ee2513e31d394c34124f96b1a5f2d1a8d397fe65d191ac001761028af02ef765647c0e6e98c0c9a72fcd9174daa53
- SSDEEP 49152:/X3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NMwzQem5M:/lRsZ47/QXoHUOfAoj1dq
- TLSH T141F58CD2A7A600E8E977F23C89558117E7F2B81743709BDF15A48A660F236D12B3F706
- MD5 SHA1 SHA512 SSDEEP TLSH
Behavioral task
behavioral1
Sample
2026-08-23_5467c18ea22ef8f3d83412babc2ff57a_coinminer_glassworm_hijackloader_icedid_njrat_ransomhub_ryuk_sliver.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Malware Config
Extracted
Family
-
meshagent
Version
-
2
Botnet
-
n1
C2
-
http://speed.ableoil.net:443/agent.ashx
Attributes
-
mesh_id
0x8AA3332460A0404D860C3E46D95525BDAA328F1C24C077E14BD0A95BE2D0EA4BA9384994844057E79C6D335B469A38CD
-
server_id
BEC956642E30BE68AB6B3ED2F40F4E784CBA349DE3EB7E116F5B22319425FB4FE4C5A6831A5CE5524C569F6F42190B24
-
wss
wss://speed.ableoil.net:443/agent.ashx
Targets
-
- Target 2026-08-23_5467c18ea22ef8f3d83412babc2ff57a_coinminer_glassworm_hijackloader_icedid_njrat_ransomhub_ryuk_sliver
- Size 3.3MB
- SHA256 fb19a64b802fe51a4b990f4c98136bffe7490188610b7c7251c84cb6ef7270fb
- MD5 5467c18ea22ef8f3d83412babc2ff57a
- SHA1 6d0ed3bf8b2d8b53189b7f1784a75e1ae7658036
- SHA512 1ef512aaa04c16d27aaf26addc435a834f6ee2513e31d394c34124f96b1a5f2d1a8d397fe65d191ac001761028af02ef765647c0e6e98c0c9a72fcd9174daa53
- SSDEEP 49152:/X3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NMwzQem5M:/lRsZ47/QXoHUOfAoj1dq
- TLSH T141F58CD2A7A600E8E977F23C89558117E7F2B81743709BDF15A48A660F236D12B3F706
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects MeshAgent payload