Overview

overview

10

Static

static

10

2024-10-12...er.exe

windows7-x64

1

2024-10-12...er.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    2024-10-12_55f2c332b61268831245cfb6892de87e_ryuk_sliver

  • Size

    3.3MB

  • MD5

    55f2c332b61268831245cfb6892de87e

  • SHA1

    f834ef82446518bb65f4cca9a0154533db9570d3

  • SHA256

    49fb8d743252c4d7095f45a68f896efd76dc93f5ba23c9681111bf9321262d6f

  • SHA512

    afa9a1a7af2e3979b13fb8f92004978eae6cb9fb5b6d1e57235228e45e2f90bbd8777074171a238f5b9b6929440a2ef3f41f28c232f318d4471f5de7a0e51ec5

  • SSDEEP

    49152:Ef708gNcR9l5NyQB7q1AlgraPgDLDVXI2RXgGfX2kMFvfAw6dZ7Nueuxg5AR:E+49lnyeG3D56gXm6HqR

Score
10/10
башнефтехимпродукт 72844830ulmeshagent

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

Башнефтехимпродукт 72844830UL

C2

http://meshcent.its.ufanet.ru:443/agent.ashx

Attributes
  • mesh_id

    0x5AD2F6D22EAD6A8CFABE9AF0994213BE7DD9E24D333AAC45EF8DDA9DE4CFFC3F81585E17336166CE5A7B0726BC3C6AE4

  • server_id

    92361DD62E17552490F9968C444EAF21618626EC916098B7A27028E3759BECFC00603247A5829F7E5F230D03F82213BF

  • wss

    wss://meshcent.its.ufanet.ru:443/agent.ashx

Signatures

  • Detects MeshAgent payload 1 IoCs
  • Meshagent family
    meshagent
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2024-10-12_55f2c332b61268831245cfb6892de87e_ryuk_sliver
    .exe windows:6 windows x64 arch:x64

    fb0a8b4a81655f744a37af985e009476


    Headers

    Imports

    Sections