Overview

overview

10

Static

static

10

2024-10-14...er.exe

windows7-x64

1

2024-10-14...er.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    2024-10-14_f1732fd38e698fbecc33284f2e4e256e_ryuk_sliver

  • Size

    3.3MB

  • MD5

    f1732fd38e698fbecc33284f2e4e256e

  • SHA1

    f9bd419d8cb2494d5ba34759cf805d373ec4fd6b

  • SHA256

    ef09713f94beccccc5852fa48fb155131322d79870988f0e98f8135f5ab71e63

  • SHA512

    8fba52695073ccc382f2bf1b5c4cca594e82794f30cb0adcb3fa61866abd19cdbe71b6e51840cbb5e262497ea8ea01a933f6584da4a7e7941492d110662fba20

  • SSDEEP

    49152:3X3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQeu5n:3lRsZ47/QXoHUOfAoj1jR

Score
10/10
1#instalaçãomeshagent

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

1#INSTALAÇÃO

C2

http://remoto.tmatecnologia.com:443/agent.ashx

Attributes
  • mesh_id

    0x5EBDD1552366079DEF93DC448CAD35820E8CDCC5539A5CCFD625857BC62C700768CA4C9495B4918172C8D69A7027EB8C

  • server_id

    4EC9E2C7EC84BE47EEBE184384444364466593790378FEAC40D1B16DA489449C3698398B5C7AD781B7ADDB8189191213

  • wss

    wss://remoto.tmatecnologia.com:443/agent.ashx

Signatures

  • Detects MeshAgent payload 1 IoCs
  • Meshagent family
    meshagent
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2024-10-14_f1732fd38e698fbecc33284f2e4e256e_ryuk_sliver
    .exe windows:6 windows x64 arch:x64

    fb0a8b4a81655f744a37af985e009476


    Headers

    Imports

    Sections