Overview

overview

10

Static

static

10

2024-10-15...er.exe

windows7-x64

1

2024-10-15...er.exe

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    2024-10-15_890a8b4eb8315a5fd443d15750f10d05_ryuk_sliver

  • Size

    3.3MB

  • MD5

    890a8b4eb8315a5fd443d15750f10d05

  • SHA1

    b0a55b2973c5260799e7c1baf62020e2594f1e96

  • SHA256

    53d0032928460340a8cb22c67662da8df498a31004ebd97ad91ff358a3c78bd0

  • SHA512

    621ecb9ecdc21f04a48d3af608313be9dee8b327a32d431b886d3ada7b24b0e13594950068efae6547c87e771f3a21d6ecd47b222957f1fc2730c2cf891c57ac

  • SSDEEP

    49152:GX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Qy:GlRsZ47/QXoHUOfAoj1x6y

Score
10/10
tacticalrmmmeshagent

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

TacticalRMM

C2

http://mesh.golden9ine.com:443/agent.ashx

Attributes
  • mesh_id

    0xEA78AEAE55808B865A9C391FE30E864BF999ABE7C9922661A6F7B3E8F3E576EAE447E62C685CAA33E1A0C5A8930D2A9A

  • server_id

    2312E6BFD45A8F95C0EA1F57EF35B9AC829501E0AAC9A43D5D61184CB20D8054BFAE1CD803F9AB8B14690E62EA816A8D

  • wss

    wss://mesh.golden9ine.com:443/agent.ashx

Signatures

  • Detects MeshAgent payload 1 IoCs
  • Meshagent family
    meshagent
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2024-10-15_890a8b4eb8315a5fd443d15750f10d05_ryuk_sliver
    .exe windows:6 windows x64 arch:x64

    fb0a8b4a81655f744a37af985e009476


    Headers

    Imports

    Sections