Overview

overview

10

Static

static

10

2024-12-23...er.exe

windows7-x64

1

2024-12-23...er.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-12-23_b97b62f5babfb7937fac9eb08b4dc7ae_ismagent_ryuk_sliver

  • Size

    3.3MB

  • Sample

    241223-w7x89sxlhr

  • MD5

    b97b62f5babfb7937fac9eb08b4dc7ae

  • SHA1

    7be91d5b9e0755a12f54c8e5fa68d775bd99b62c

  • SHA256

    716b62410405b15a34087660d58c3eb790fd504cd785d4a34cc1a2d141738af3

  • SHA512

    d500f99bea5b258b45cec2a9702f12eb8f8346317ea17f4db2ac858e800e5622cdbd1d949367c711f051aaaca1ff85ae15b99e71479b3a748e62eb1d387b7cba

  • SSDEEP

    49152:bX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Q2:blRsZ47/QXoHUOfAoj1x62

Score
10/10
meshagentlocotech-signal

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

LOCOTECH-SIGNAL

C2

http://techsupport.myftp.org:443/agent.ashx

Attributes
  • mesh_id

    0xC80D461B1E8024034C7A83BC30F12C1CD76D281EA78FD18145E19173DC8C8E506370985A38783F270979849927CF3C77

  • server_id

    A5D0014DC4EDF37515379D28C8FA94CF07B7E21E122A1EC1CF8EC599571CA6527C3C23F8EDB99AD0C14EBB3BE704B0ED

  • wss

    wss://techsupport.myftp.org:443/agent.ashx

Targets

    • Target

      2024-12-23_b97b62f5babfb7937fac9eb08b4dc7ae_ismagent_ryuk_sliver

    • Size

      3.3MB

    • MD5

      b97b62f5babfb7937fac9eb08b4dc7ae

    • SHA1

      7be91d5b9e0755a12f54c8e5fa68d775bd99b62c

    • SHA256

      716b62410405b15a34087660d58c3eb790fd504cd785d4a34cc1a2d141738af3

    • SHA512

      d500f99bea5b258b45cec2a9702f12eb8f8346317ea17f4db2ac858e800e5622cdbd1d949367c711f051aaaca1ff85ae15b99e71479b3a748e62eb1d387b7cba

    • SSDEEP

      49152:bX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Q2:blRsZ47/QXoHUOfAoj1x62

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks