Overview

overview

10

Static

static

10

2024-11-18...er.exe

windows7-x64

1

2024-11-18...er.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-11-18_4fbb194b9f4675afd0a4b8d744ef6310_ismagent_ryuk_sliver

  • Size

    3.2MB

  • Sample

    241118-x2m2satjcs

  • MD5

    4fbb194b9f4675afd0a4b8d744ef6310

  • SHA1

    d8f172af8c041e1f7cb6de094c26c72782f9346f

  • SHA256

    79eb1c43913cb10227645c371fa0b10d02ab0546b7f8b23bc434c3cbaf96dc86

  • SHA512

    dbfd478b66bae808e23a7e37eb52cfd6395a8ca261b07536f62bf9fec79ea8930d743583a5594bef8e32fa27c03ca8c52d57fc97c27b37961200aab73ae0645c

  • SSDEEP

    49152:PX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe+:PlRsZ47/QXoHUOfAoj1l

Score
10/10
meshagentrobbin

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

robbin

C2

http://172.232.102.54:443/agent.ashx

Attributes
  • mesh_id

    0xF843C931D6D41192A06910CD216CBBC848B2593C2F62DE60305D39252F33789BCA17507D0ABB84DD3BE615F729B33938

  • server_id

    6BE103485BAC23D50467F1CF77DC0C324944B61664D5F0DBF5AD40BFF7083CCAFC5ECF27219AEDD7E61E561F6EC0267E

  • wss

    wss://172.232.102.54:443/agent.ashx

Targets

    • Target

      2024-11-18_4fbb194b9f4675afd0a4b8d744ef6310_ismagent_ryuk_sliver

    • Size

      3.2MB

    • MD5

      4fbb194b9f4675afd0a4b8d744ef6310

    • SHA1

      d8f172af8c041e1f7cb6de094c26c72782f9346f

    • SHA256

      79eb1c43913cb10227645c371fa0b10d02ab0546b7f8b23bc434c3cbaf96dc86

    • SHA512

      dbfd478b66bae808e23a7e37eb52cfd6395a8ca261b07536f62bf9fec79ea8930d743583a5594bef8e32fa27c03ca8c52d57fc97c27b37961200aab73ae0645c

    • SSDEEP

      49152:PX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe+:PlRsZ47/QXoHUOfAoj1l

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks