Overview

overview

10

Static

static

10

2024-10-12...er.exe

windows7-x64

1

2024-10-12...er.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    2024-10-12_580f37dd9189748835e623704ca37a6b_ryuk_sliver

  • Size

    3.3MB

  • MD5

    580f37dd9189748835e623704ca37a6b

  • SHA1

    a1286fd5297fa0555c282555373f16e0121548dc

  • SHA256

    6f1e8f9999257ea11acb232281903901802cd85fb3a68dbbc83c87ddb32160f1

  • SHA512

    37d32b043c6e8c83d80736ffd6de1dde92e59765c7356276f9979c9d21d3623aece1b291fc97e2b3899d6b00b84b330e75a02ca8417f657473e25698e002a8e3

  • SSDEEP

    49152:FX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85QP:FlRsZ47/QXoHUOfAoj1x6P

Score
10/10
tacticalrmmmeshagent

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

TacticalRMM

C2

http://mesh.techilogicit.com:443/agent.ashx

Attributes
  • mesh_id

    0x03AC90B12E15244C5415FC0828FEFA9332E88DA19197BAF413059CA84105EB1E94A7BE3128E4E33FBC742E08703E7031

  • server_id

    446B305BF129CE389761C69B073EEF39C31C7FA351AE2AF9F61E6F48B537598740911578F70AFF1606B386171FEE18B0

  • wss

    wss://mesh.techilogicit.com:443/agent.ashx

Signatures

  • Detects MeshAgent payload 1 IoCs
  • Meshagent family
    meshagent
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2024-10-12_580f37dd9189748835e623704ca37a6b_ryuk_sliver
    .exe windows:6 windows x64 arch:x64

    fb0a8b4a81655f744a37af985e009476


    Headers

    Imports

    Sections