Overview

overview

10

Static

static

10

2024-11-12...er.exe

windows7-x64

1

2024-11-12...er.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-11-12_9907dcbeae2027cdcb61d1168e34cbfb_ismagent_ryuk_sliver

  • Size

    3.3MB

  • Sample

    241112-rs7f6stkgv

  • MD5

    9907dcbeae2027cdcb61d1168e34cbfb

  • SHA1

    8464b6e067cbe38c0664a35dee10fce6e6795843

  • SHA256

    85263d4e4147cbe4991a351c6a8a3f165c88f61384ed61582ca92d99da473d4d

  • SHA512

    602631a874ca9a44bcb701c3259ba02b2c971d01ed1412c28bd004ba0b6881ae18dd1c7987abf5711911a0657e0b5c44963349b0d5751df9c396e870724546c9

  • SSDEEP

    49152:1X3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Q3+:1lRsZ47/QXoHUOfAoj1x6O

Score
10/10
meshagenttacticalrmm

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

TacticalRMM

C2

http://mesh.synctech.uk:443/agent.ashx

Attributes
  • mesh_id

    0x8A4E6F34540B677A4BEC7BEC592AE80426B445CE06F72FB12395465ECF9DE53EDA46149FFF711786D503B5253ED6B22B

  • server_id

    C6769D465C8AB23000BFC870283C3403D772B48B98252C5D7283267E306A70D6AADE351BDC5A29870BBB8DE2078F50DA

  • wss

    wss://mesh.synctech.uk:443/agent.ashx

Targets

    • Target

      2024-11-12_9907dcbeae2027cdcb61d1168e34cbfb_ismagent_ryuk_sliver

    • Size

      3.3MB

    • MD5

      9907dcbeae2027cdcb61d1168e34cbfb

    • SHA1

      8464b6e067cbe38c0664a35dee10fce6e6795843

    • SHA256

      85263d4e4147cbe4991a351c6a8a3f165c88f61384ed61582ca92d99da473d4d

    • SHA512

      602631a874ca9a44bcb701c3259ba02b2c971d01ed1412c28bd004ba0b6881ae18dd1c7987abf5711911a0657e0b5c44963349b0d5751df9c396e870724546c9

    • SSDEEP

      49152:1X3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Q3+:1lRsZ47/QXoHUOfAoj1x6O

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks