Overview

overview

10

Static

static

10

2024-12-09...er.exe

windows7-x64

1

2024-12-09...er.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-12-09_79587b94126b2611f6edd9ea7ddf1282_ismagent_ryuk_sliver

  • Size

    3.3MB

  • Sample

    241209-x8jmyatlcp

  • MD5

    79587b94126b2611f6edd9ea7ddf1282

  • SHA1

    80dd1c6fe1557764b8f73d3510e0c7dffee66f23

  • SHA256

    d3c2ecb3d690d956fd2310e72852273c04aa1feb54621ec67284437ccfa2520c

  • SHA512

    0b4d32dd54c1dc9e187d0c917a17123e91a095cebcc071856f1bdd38bc8cfd5196a71dbd4064fe5306c33559d4f9cb2bcffcfcca6607ac906efd54e54437fa45

  • SSDEEP

    49152:tf708gNcR9l5NyQB7q1AlgraPgDLDVXI2RXgGfX2kMFvfAw6dZ7Nueuxg5Ae:t+49lnyeG3D56gXm6Hqe

Score
10/10
meshagentservergrp

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

ServerGRP

C2

http://mesh.baltrosgroup.com:443/agent.ashx

Attributes
  • mesh_id

    0x00759335DB087147A43FCEF3AF9643545CC199C44E7A18B5AF4C3A4FBC85B5981086E99B15CCBCC91AEAC0DA57D62AEA

  • server_id

    0ACCEDFAF09C4FDC5C21FE6DB2288950AA7282E5389B30A8D78BA429AD4F868BFECBC3D1047D3EF5F2AA41B0D3D9CBB7

  • wss

    wss://mesh.baltrosgroup.com:443/agent.ashx

Targets

    • Target

      2024-12-09_79587b94126b2611f6edd9ea7ddf1282_ismagent_ryuk_sliver

    • Size

      3.3MB

    • MD5

      79587b94126b2611f6edd9ea7ddf1282

    • SHA1

      80dd1c6fe1557764b8f73d3510e0c7dffee66f23

    • SHA256

      d3c2ecb3d690d956fd2310e72852273c04aa1feb54621ec67284437ccfa2520c

    • SHA512

      0b4d32dd54c1dc9e187d0c917a17123e91a095cebcc071856f1bdd38bc8cfd5196a71dbd4064fe5306c33559d4f9cb2bcffcfcca6607ac906efd54e54437fa45

    • SSDEEP

      49152:tf708gNcR9l5NyQB7q1AlgraPgDLDVXI2RXgGfX2kMFvfAw6dZ7Nueuxg5Ae:t+49lnyeG3D56gXm6Hqe

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks