Overview

overview

10

Static

static

10

2024-11-22...er.exe

windows7-x64

1

2024-11-22...er.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-11-22_f781d251564a7275c42855a8272f60d9_ismagent_ryuk_sliver

  • Size

    3.3MB

  • Sample

    241122-lm3m5strfk

  • MD5

    f781d251564a7275c42855a8272f60d9

  • SHA1

    19edb34cf191a67f161d51d53a6a07573c93197d

  • SHA256

    669f63893f8fd108d9db17ce180722d8cbb2a2bc2db041294803fd9bd5b021c9

  • SHA512

    0db0cdce72066e0f44f1bf845ee68a5531be54fc578801ffbe017f2e9f04b9b904db82ac2a9722e0e858b3917e40a095d2e8f08cf435691d98e4e65fc16233e7

  • SSDEEP

    49152:XX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85QX:XlRsZ47/QXoHUOfAoj1x6X

Score
10/10
meshagenttacticalrmm

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

TacticalRMM

C2

http://mesh-it.simba.sg:443/agent.ashx

Attributes
  • mesh_id

    0x86EE97F9DF005F1E0F45744EBF365763B82901A1D732A3ACC2861BF4871B19401102C17CA20B8474D29D00A879D77A79

  • server_id

    F93D7EE2BD6D42CF683D2D67376A94AD4FDCC2BBD81A0B654125C7C42D10D3A90786112172B4155C1AA020348EE0A47C

  • wss

    wss://mesh-it.simba.sg:443/agent.ashx

Targets

    • Target

      2024-11-22_f781d251564a7275c42855a8272f60d9_ismagent_ryuk_sliver

    • Size

      3.3MB

    • MD5

      f781d251564a7275c42855a8272f60d9

    • SHA1

      19edb34cf191a67f161d51d53a6a07573c93197d

    • SHA256

      669f63893f8fd108d9db17ce180722d8cbb2a2bc2db041294803fd9bd5b021c9

    • SHA512

      0db0cdce72066e0f44f1bf845ee68a5531be54fc578801ffbe017f2e9f04b9b904db82ac2a9722e0e858b3917e40a095d2e8f08cf435691d98e4e65fc16233e7

    • SSDEEP

      49152:XX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85QX:XlRsZ47/QXoHUOfAoj1x6X

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks