Extracted

• • Target

    2024-12-03_0aa9dc10bf05ec4c4d4b9baa5cbb6f1f_ismagent_ryuk_sliver

  • Size

    2.9MB

  • MD5

    0aa9dc10bf05ec4c4d4b9baa5cbb6f1f

  • SHA1

    6f157cb52d687a9b960bf67aa2448fc7e5d2db17

  • SHA256

    cfc9778f772c8c8daa33a520e3adbfa7fad6b33ee0d5dd104f5580eaf52eed82

  • SHA512

    cb36426922341cf3586caa15cbf05982df8ed9df4cc4faccb1c9ac4e3c193a17ac04cc4c0987bcf6f6223c07e6ff3055be3d1d00b963fb65495887916179e13d

  • SSDEEP

    49152:iiQagHg5EVhwQd+qrW+i1w+Tqc0KxZbDOCwMDbyeKw3FGMFvfjPW21I3iIJn:3g7hRdj9iMlHBSFBWZn

  Score

  10^/10

  meshagenttestbackdoordiscoveryevasionpersistenceprivilege_escalationrattrojan

  • Detects MeshAgent payload

  • MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

    rattrojanbackdoormeshagent

  • Meshagent family

    meshagent

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2