Overview

overview

10

Static

static

10

2024-10-06...er.exe

windows7-x64

1

2024-10-06...er.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    2024-10-06_0d4fb37315ef3320bd4e58c8c46b1b2d_ryuk_sliver

  • Size

    3.4MB

  • MD5

    0d4fb37315ef3320bd4e58c8c46b1b2d

  • SHA1

    cdb0b16d8021b7afc8c52b2cf18f65a2b2aeb6d2

  • SHA256

    0c30f40a40462ff802e50e0e736c70c0955bc861f3e5ab79f606a8e3b9e8dc03

  • SHA512

    2777d2c68e66207a5ccf9125b3d8e3f1008682f41b463f74df591902f23e4fdf804e0d0c168eb6ade1560bff7c83361ccf651191f08af43bd58991a417bb8142

  • SSDEEP

    49152:VX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQeS5q17S:VlRsZ47/QXoHUOfAoj1X817wFkyl

Score
10/10
tacticalrmmmeshagent

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

TacticalRMM

C2

http://mesh.newtactical.buzz:443/agent.ashx

Attributes
  • mesh_id

    0x61F838E2BDB0206A28E8B739C4D0CBC09D03B9F8508EFE3AF6381158E85728B8D60ABA4A890F9549E6527B82116A9B7A

  • server_id

    5A55378C835582193041D26955989D0A8F3584725191A5CFBCDE0D443422A896C8A489D38A395351A40226E40FB695C6

  • wss

    wss://mesh.newtactical.buzz:443/agent.ashx

Signatures

  • Detects MeshAgent payload 1 IoCs
  • Meshagent family
    meshagent
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2024-10-06_0d4fb37315ef3320bd4e58c8c46b1b2d_ryuk_sliver
    .exe windows:6 windows x64 arch:x64

    fb0a8b4a81655f744a37af985e009476


    Headers

    Imports

    Sections