meshagent | f656e9c42f85a5ef6b7a499a05f63782cbaafd57d5cdb471f2365b5ff1b5e3e1 | Triage™

Login
Reports

Overview

overview

Static

static

2026-10-12...er.exe

windows10-2004-x64

2026-10-12...er.exe

windows11-ltsc_2024-x64

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-12_e52220dfe66878b13be7050874335610_amadey_coinminer_elex_glassworm_luca-stealer_njrat_ransomhub_remcos_smoke-loader
Size 3.7MB
Sample261013-xpqbdayx2n
SHA256 f656e9c42f85a5ef6b7a499a05f63782cbaafd57d5cdb471f2365b5ff1b5e3e1
MD5 e52220dfe66878b13be7050874335610
SHA1 dc5cc478ab39d4dd60a4be64f671955ea58fe0f7
SHA512 18a01d5df596ef93d45942b2ed83caed6a74da12f1844011b6404e0d5e63f44cceaba03c8ff80acfba34728d8c13f412cb1dedb212818c097bd83209bf326ff9
SSDEEP 49152:VXfEV3ugKeuWoAkf6bRexQlNIdwB0pJCWJ0+1NaZPwqe5MZPa:JfEYnnfKthWq+17KZPa
TLSH
T1B106AEC2BB834571F8A736B411AB53BE5D7D69130328D4C3D3D429A989316D0AE3B39B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

meshagent sentinel connections backdoor defense_evasion discovery execution impact ransomware rat trojan

Static task

static1

3 signatures

sentinel connections rat trojan backdoor meshagent

Behavioral task

behavioral1

Sample

2026-10-12_e52220dfe66878b13be7050874335610_amadey_coinminer_elex_glassworm_luca-stealer_njrat_ransomhub_remcos_smoke-loader.exe

Resource

win10v2004-20260911-en

windows10-2004-x64

10 signatures

150 seconds

backdoor sentinel connections defense_evasion discovery execution meshagent impact ransomware rat trojan

Behavioral task

behavioral2

Sample

2026-10-12_e52220dfe66878b13be7050874335610_amadey_coinminer_elex_glassworm_luca-stealer_njrat_ransomhub_remcos_smoke-loader.exe

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

10 signatures

150 seconds

backdoor sentinel connections defense_evasion discovery execution meshagent impact ransomware rat trojan

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

Sentinel Connections

C2

http://meshserver.net:443/agent.ashx

Attributes

mesh_id
0x8CD5A26AEEC0CAE34887959E8BB7B59405EAAFA59D881B900A107C7E15E4903CA2938A5C3F0376B3970E6098DBEEED2A
server_id
17FE2257E50AE3385ACEC631087405613193F8D5C915B47F123D049FB525022969CA4D12B37B50C77B3D3D4BF886BC66
wss
wss://meshserver.net:443/agent.ashx

Targets

- Target
  2026-10-12_e52220dfe66878b13be7050874335610_amadey_coinminer_elex_glassworm_luca-stealer_njrat_ransomhub_remcos_smoke-loader
- Size 3.7MB
- SHA256 f656e9c42f85a5ef6b7a499a05f63782cbaafd57d5cdb471f2365b5ff1b5e3e1
- MD5 e52220dfe66878b13be7050874335610
- SHA1 dc5cc478ab39d4dd60a4be64f671955ea58fe0f7
- SHA512 18a01d5df596ef93d45942b2ed83caed6a74da12f1844011b6404e0d5e63f44cceaba03c8ff80acfba34728d8c13f412cb1dedb212818c097bd83209bf326ff9
- SSDEEP 49152:VXfEV3ugKeuWoAkf6bRexQlNIdwB0pJCWJ0+1NaZPwqe5MZPa:JfEYnnfKthWq+17KZPa
- TLSH
  T1B106AEC2BB834571F8A736B411AB53BE5D7D69130328D4C3D3D429A989316D0AE3B39B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor sentinel connections defense_evasion discovery execution meshagent impact ransomware rat trojan
- Detects MeshAgent payload
- Family: MeshAgent
  MeshAgent is an open source remote access trojan written in C++.
  rat trojan backdoor meshagent
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

Indicator Removal

File Deletion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

sentinel connectionsrattrojanbackdoormeshagent

behavioral1

backdoorsentinel connectionsdefense_evasiondiscoveryexecutionmeshagentimpactransomwarerattrojan

behavioral2

backdoorsentinel connectionsdefense_evasiondiscoveryexecutionmeshagentimpactransomwarerattrojan

© 2018-2026

Terms | Privacy