meshagent | 2026-11-01_85a1ea9e5375ef00451cbd91a56f91b6_amadey_coinminer_elex_glassworm_luca-stealer_njrat_ransomhub_remcos_revil_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_85a1ea9e5375ef00451cbd91a56f91b6_amadey_coinminer_elex_glassworm_luca-stealer_njrat_ransomhub_remcos_revil_smoke-loader
Size 3.6MB
Sample261102-thnmesdv5n
SHA256 383325891014cbe75ce717c93b0f2d27bcc9932dc38f5dce35101b5e49dff4c0
MD5 85a1ea9e5375ef00451cbd91a56f91b6
SHA1 a9b02c0733af56260d2c0c6c7d7804beb7cfbdb0
SHA512 d6568998ba42a76fa048b551abfae9ab81802e0948ecbb2eb19eb3d2b22d0bce72ee8fb537bbab4188f653b4f0058d3a4a50032455345436abce6e22bc7f13e0
SSDEEP 49152:9NS2PF6/S6QfJeZ+UawYjUAiwTtq3VFszQvZ/+OKc+ZPAqT5f9j3:i2PFXLOa7tiNWMQOKp99T
TLSH
T11E06AEC2BB834471F8A736B511AB53BE5D7D69530328D4C393D429E98C316D0AE3B39A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat trojan backdoor meshagent

Malware Config

Signatures

Family: MeshAgent
MeshAgent is an open source remote access trojan written in C++.
rat trojan backdoor meshagent

Detects MeshAgent payload 1 IoCs

resource	yara_rule
sample	family_meshagent

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-11-01_85a1ea9e5375ef00451cbd91a56f91b6_amadey_coinminer_elex_glassworm_luca-stealer_njrat_ransomhub_remcos_revil_smoke-loader

File Explorer

2026-11-01_85a1ea9e5375ef00451cbd91a56f91b6_amadey_coinminer_elex_glassworm_luca-stealer_njrat_ransomhub_remcos_revil_smoke-loader

.exe 3.6MB

2026-11-01_85a1ea9e5375ef00451cbd91a56f91b6_amadey_coinminer_elex_glassworm_luca-stealer_njrat_ransomhub_remcos_revil_smoke-loader

IMPHASH ce76bef61a1e81509096f4a563ffeddc
SHA256 383325891014cbe75ce717c93b0f2d27bcc9932dc38f5dce35101b5e49dff4c0
MD5 85a1ea9e5375ef00451cbd91a56f91b6
SHA1 a9b02c0733af56260d2c0c6c7d7804beb7cfbdb0
SHA512 d6568998ba42a76fa048b551abfae9ab81802e0948ecbb2eb19eb3d2b22d0bce72ee8fb537bbab4188f653b4f0058d3a4a50032455345436abce6e22bc7f13e0
SSDEEP 49152:9NS2PF6/S6QfJeZ+UawYjUAiwTtq3VFszQvZ/+OKc+ZPAqT5f9j3:i2PFXLOa7tiNWMQOKp99T
TLSH
T11E06AEC2BB834471F8A736B511AB53BE5D7D69530328D4C393D429E98C316D0AE3B39A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects MeshAgent payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

cb:3a:74:26:fb:f3:b2:ba:03:74:73:34:27:03:02:c7:3e:34:7a:28:56:c9:39:7d:66:ad:3a:7a:a2:37:ea:01:00:97:82:4c:03:a1:c5:66:ae:41:90:ce:eb:ed:7c:9a

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=un-configured-836c71

Chains

Oct 9, 2026

CN=un-configured-836c71

CN=MeshCentralRoot-6dd0be,O=unknown,C=unknown

Subject

CN=un-configured-836c71

Serial Number

42:28:19:85:20

Issuer

CN=MeshCentralRoot-6dd0be,O=unknown,C=unknown

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 1, 2018 - Dec 31, 2049

Subject

CN=MeshCentralRoot-6dd0be,O=unknown,C=unknown

Serial Number

25:79:19:45:56

Issuer

CN=MeshCentralRoot-6dd0be,O=unknown,C=unknown

Key Usages

KeyUsageCertSign

Timespan

Jan 1, 2018 - Dec 31, 2049

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

1841472

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Default.DESKTOP-9CGK2DI\Desktop\AmtWebApp\MeshAgent\Release\MeshService.pdb

comctl32

InitCommonControlsEx

crypt32

CertSetCertificateContextProperty CertDuplicateCertificateContext CertDeleteCertificateFromStore CryptAcquireCertificatePrivateKey CertAddEncodedCertificateToStore CryptMsgClose CryptMsgUpdate CryptExportPublicKeyInfo CertCreateSelfSignCertificate CertFreeCertificateContext CryptMsgOpenToEncode CertAddCertificateContextToStore CryptMsgOpenToDecode CryptMsgControl PFXExportCertStore CertEnumCertificatesInStore CertOpenSystemStoreW CertStrToNameW CertOpenStore CryptMsgCalculateEncodedLength CertFindCertificateInStore CertGetCertificateContextProperty CryptEncodeObject CryptMsgGetParam CertStrToNameA CertCloseStore CryptSignAndEncodeCertificate

ncrypt

NCryptCreatePersistedKey BCryptGetProperty BCryptOpenAlgorithmProvider NCryptOpenStorageProvider BCryptCreateHash NCryptSetProperty BCryptHashData NCryptFreeObject NCryptFinalizeKey BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGenRandom

dbghelp

SymInitialize SymFromAddr MiniDumpWriteDump SymGetModuleBase64 SymGetLineFromAddr64 SymFunctionTableAccess64 StackWalk64

iphlpapi

GetAdaptersAddresses SendARP ConvertLengthToIpv4Mask GetAdaptersInfo

ws2_32

__WSAFDIsSet htons htonl gethostname ntohs ntohl WSAGetLastError ioctlsocket recv send gethostbyname getaddrinfo freeaddrinfo getnameinfo WSASetLastError getsockname WSASocketW listen closesocket bind accept WSACleanup FreeAddrInfoW select WSACloseEvent WSACreateEvent WSAStartup WSAEventSelect WSAResetEvent GetAddrInfoW WSAIoctl shutdown connect recvfrom getsockopt sendto socket setsockopt

gdiplus

GdipCloneImage GdiplusShutdown GdipGetImageEncoders GdipDisposeImage GdipLoadImageFromStreamICM GdipFree GdipGetImageEncodersSize GdipSaveImageToStream GdipLoadImageFromStream GdiplusStartup GdipAlloc

kernel32

InterlockedPushEntrySList InterlockedFlushSList RtlUnwind EnterCriticalSection LeaveCriticalSection GetFullPathNameW GetStdHandle WriteFile LoadLibraryExA GetModuleFileNameW GetSystemPowerStatus OpenProcess MultiByteToWideChar Sleep GetLastError CloseHandle GetCurrentDirectoryW SetCurrentDirectoryW GetProcAddress SetEnvironmentVariableA CreateProcessW FreeLibrary WideCharToMultiByte GetCurrentThreadId GetModuleHandleA WaitForSingleObjectEx CreateThread QueueUserAPC OpenThread ReadFile LoadLibraryA SleepEx SetSystemPowerState GetCurrentProcess SetThreadExecutionState HeapFree HeapAlloc GetProcessHeap SystemTimeToFileTime GetSystemTime DeleteCriticalSection QueryPerformanceFrequency SystemTimeToTzSpecificLocalTime QueryPerformanceCounter ReleaseSemaphore WaitForSingleObject CreateSemaphoreA CancelIo FindFirstFileW FindNextFileW RemoveDirectoryW GetFinalPathNameByHandleW GetDriveTypeA SetFilePointer FindFirstVolumeA FindClose CreateFileW GetVolumePathNamesForVolumeNameA GetFileAttributesExW ReadDirectoryChangesW FindNextVolumeA FindVolumeClose GetDiskFreeSpaceExA CreateEventA GetModuleHandleExA WaitForMultipleObjectsEx CreateNamedPipeA DisconnectNamedPipe CreateFileA CancelIoEx LocalFree ConnectNamedPipe SetConsoleMode GetStartupInfoW SetConsoleOutputCP IsDebuggerPresent TerminateProcess GetTempPathW CancelSynchronousIo SetEvent ResetEvent GetThreadId GetCurrentProcessId GetEnvironmentStrings FreeEnvironmentStringsA CopyFileW MoveFileW RtlCaptureContext SuspendThread ResumeThread DuplicateHandle ExitThread GetTickCount64 GetCurrentThread DeleteFileA GetOverlappedResult GetThreadContext WTSGetActiveConsoleSessionId GetExitCodeProcess SetEndOfFile DeleteFileW SetFilePointerEx SetConsoleCtrlHandler FreeConsole LoadLibraryExW SetLastError GetFileType GetModuleHandleW FormatMessageW SwitchToFiber DeleteFiber CreateFiber GetSystemTimeAsFileTime ConvertFiberToThread ConvertThreadToFiber GetEnvironmentVariableW ReadConsoleA ReadConsoleW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW CreateProcessA HeapValidate GetSystemInfo CreateDirectoryW GetConsoleCP MoveFileExW SetEnvironmentVariableW SetCurrentDirectoryA GetCurrentDirectoryA GetTimeZoneInformation SetStdHandle GetDriveTypeW PeekNamedPipe GetModuleFileNameA GetCommandLineA GetCommandLineW GetACP RaiseException GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetConsoleMode InitializeSListHead GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers HeapReAlloc HeapSize HeapQueryInformation GetStringTypeW WriteConsoleW GetCPInfo GetFullPathNameA OutputDebugStringA OutputDebugStringW FindFirstFileExA FindFirstFileExW FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW EncodePointer FileTimeToSystemTime DecodePointer

user32

EndDialog SetWindowTextW GetWindowPlacement ShowWindow GetDlgCtrlID SetWindowPlacement SetWindowTextA IsDlgButtonChecked GetDlgItem CheckDlgButton DialogBoxParamW EnableWindow MessageBeep ExitWindowsEx GetUserObjectInformationA EnumDisplayMonitors GetSystemMetrics SetThreadDesktop GetThreadDesktop CloseDesktop BlockInput GetMonitorInfoA OpenInputDesktop GetKeyState GetMessageA GetMessageExtraInfo SendMessageW LoadCursorA DestroyWindow GetDC PostMessageA GetIconInfo CallNextHookEx GetCursorInfo SetWindowsHookExA MapVirtualKeyA GetForegroundWindow UnhookWindowsHookEx DefWindowProcA CreateWindowExA TranslateMessage UnregisterClassA DrawIconEx SetWinEventHook RegisterClassExA UnhookWinEvent SetForegroundWindow ReleaseDC SendInput SetProcessDPIAware MessageBoxW GetUserObjectInformationW GetProcessWindowStation DispatchMessageA CreateWindowExW GetWindowRect

gdi32

DeleteObject GetDIBits CreateCompatibleDC SelectObject CreateCompatibleBitmap SetStretchBltMode DeleteDC StretchBlt BitBlt GetObjectA CreateSolidBrush SetBkColor SetBkMode SetTextColor GetStockObject

advapi32

RegDeleteKeyA RegSetValueExA CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource StartServiceCtrlDispatcherA QueryServiceStatus CloseServiceHandle AllocateAndInitializeSid SetServiceStatus OpenSCManagerA RegisterServiceCtrlHandlerExA FreeSid CheckTokenMembership OpenServiceA SetTokenInformation CreateProcessAsUserW DuplicateTokenEx SetSecurityDescriptorDacl SetEntriesInAclA InitializeSecurityDescriptor CryptDestroyKey RegQueryValueExA RegSetValueExW RegOpenKeyExW RegQueryValueExW CryptReleaseContext AdjustTokenPrivileges LookupPrivilegeValueA InitiateSystemShutdownA OpenProcessToken RegOpenKeyExA RegCreateKeyW RegCloseKey

shell32

ShellExecuteExW

ole32

CoInitializeEx CreateStreamOnHGlobal CoUninitialize CoCreateInstance

oleaut32

SysFreeString SysAllocString SysStringLen

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_85a1ea9e5375ef00451cbd91a56f91b6_amadey_coinminer_elex_glassworm_luca-stealer_njrat_ransomhub_remcos_revil_smoke-loader

PE Signature issue

comctl32

crypt32

ncrypt

dbghelp

iphlpapi

ws2_32

gdiplus

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

generic