Overview

overview

10

Static

static

10

2024-11-03...er.exe

windows7-x64

1

2024-11-03...er.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-11-03_6ff3e6cdc6a9fb93c0456a327394120f_ryuk_sliver

  • Size

    3.3MB

  • Sample

    241103-x4xzrs1mfy

  • MD5

    6ff3e6cdc6a9fb93c0456a327394120f

  • SHA1

    aa72d94fb432f72974f8a424e66ae0637a307413

  • SHA256

    5ac3dfbfa879cc85b3c4f6a12947b7a0b439ee4ea1dbae33382c96763550e148

  • SHA512

    a1c4e5011e95a89e7696204ebedce5a915967b3eab6c3dfaf7807420a3f12d5315e22faa1db8f3a578f3985be9993f5eff58df797e5dd9f9410a73d0b9304d77

  • SSDEEP

    49152:2X3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85QC:2lRsZ47/QXoHUOfAoj1x6C

Score
10/10
meshagentdazjedlm

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

DAZJEDLM

C2

http://central.vim.sa:443/agent.ashx

Attributes
  • mesh_id

    0xB65ACC5AD707239C36F7DB67B8CB11CBD1D81112EC0E9AF458EE74AF0A1C3C255C7BA8008C9EEEBDEC66101C9BAB87D9

  • server_id

    D7919D5351974D7713E064326C7EE2CF8C0AA82C82EE4695679891FCB699581D263F25F4A5E33DCECC1EEA499AEDAC0C

  • wss

    wss://central.vim.sa:443/agent.ashx

Targets

    • Target

      2024-11-03_6ff3e6cdc6a9fb93c0456a327394120f_ryuk_sliver

    • Size

      3.3MB

    • MD5

      6ff3e6cdc6a9fb93c0456a327394120f

    • SHA1

      aa72d94fb432f72974f8a424e66ae0637a307413

    • SHA256

      5ac3dfbfa879cc85b3c4f6a12947b7a0b439ee4ea1dbae33382c96763550e148

    • SHA512

      a1c4e5011e95a89e7696204ebedce5a915967b3eab6c3dfaf7807420a3f12d5315e22faa1db8f3a578f3985be9993f5eff58df797e5dd9f9410a73d0b9304d77

    • SSDEEP

      49152:2X3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85QC:2lRsZ47/QXoHUOfAoj1x6C

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks