Overview

overview

10

Static

static

10

2024-10-12...er.exe

windows7-x64

1

2024-10-12...er.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-10-12_3802edf7f09def1188aaa4e05dbe9714_ryuk_sliver

  • Size

    3.3MB

  • MD5

    3802edf7f09def1188aaa4e05dbe9714

  • SHA1

    153c387e6031f17c5bfa41d469e378535e0ae60a

  • SHA256

    265cd358a5e7f22a21be634c7c286f97a6aec678a05d439fffe11801adc13639

  • SHA512

    f6b2a878fd368ed21cce817d2174bf285ca9825f59c30bcbb2fe3ecaeb55b5524aed30b12f4027d126dd4c697bbe1f501b7f7fd46fb415f3f458f24688564fee

  • SSDEEP

    49152:lf708gNcR9l5NyQB7q1AlgraPgDLDVXI2RXgGfX2kMFvfAw6dZ7Nueuxg5AG:l+49lnyeG3D56gXm6HqG

Score
10/10
архив 513meshagent

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

Архив 513

C2

http://mesh.lst.gr:443/agent.ashx

Attributes
  • mesh_id

    0x509C0E39A4343859A313AACCC8339D4493478AABF2A76E7FEF85C670F423BD63AF478E930AB14B1CBBCC5F63FF9F0EEC

  • server_id

    3A9EF39E02D81E6BC2301E0998124BCD1FA5B8CC309E96CC6EDBD0BC1FEA1D3BD2307B99508231581B000252BC3447A1

  • wss

    wss://mesh.lst.gr:443/agent.ashx

Signatures

  • Detects MeshAgent payload 1 IoCs
  • Meshagent family
    meshagent
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2024-10-12_3802edf7f09def1188aaa4e05dbe9714_ryuk_sliver
    .exe windows:6 windows x64 arch:x64

    fb0a8b4a81655f744a37af985e009476


    Headers

    Imports

    Sections