meshagent | 2024-12-26_20941c81c4583a4059a5124d94e903fd_ismagent_ryuk_sliver

Sharing

Copy URL Twitter E-mail

General

Target
2024-12-26_20941c81c4583a4059a5124d94e903fd_ismagent_ryuk_sliver
Size 3.3MB
Sample241226-efgnrswpan
SHA256 b263a0eebdf0f5c7454b20301d339970807270c55eda64ecd24300930b2c33b8
MD5 20941c81c4583a4059a5124d94e903fd
SHA1 4b8b4b88225724cae3189a2f3a2b4e8b4573af34
SHA512 0f13f93f4eda3f23294411d8c638891af2903f02b7495ae2a2009cfbc5bec5885b539f24af351ae00e67b14ed2362d245797fc193ef061eb4084144909dc9398
SSDEEP 49152:AX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQeH5W:AlRsZ47/QXoHUOfAoj1qQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

in work meshagent

Malware Config

Extracted

Family

meshagent

Version

Botnet

In Work

http://svc.odwebp.com:443/agent.ashx

Attributes

mesh_id
0xB7A0A1B0F8F629ED87A30F70A87024B5A1F792A2D9FB4D07808A233BC913A980429ACCB067292FC4283A1D2D9519AE63
server_id
C124876C541773871C230C34134AE728E14C628B32D0945B9C56C620D36751541CFD864EB5BF5919C8F9E77F5F731F49
wss
wss://svc.odwebp.com:443/agent.ashx

Signatures

Detects MeshAgent payload 1 IoCs

resource	yara_rule
sample	family_meshagent

Meshagent family
meshagent

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-12-26_20941c81c4583a4059a5124d94e903fd_ismagent_ryuk_sliver

File Explorer

2024-12-26_20941c81c4583a4059a5124d94e903fd_ismagent_ryuk_sliver

.exe 3.3MB

2024-12-26_20941c81c4583a4059a5124d94e903fd_ismagent_ryuk_sliver

IMPHASH fb0a8b4a81655f744a37af985e009476
SHA256 b263a0eebdf0f5c7454b20301d339970807270c55eda64ecd24300930b2c33b8
MD5 20941c81c4583a4059a5124d94e903fd
SHA1 4b8b4b88225724cae3189a2f3a2b4e8b4573af34
SHA512 0f13f93f4eda3f23294411d8c638891af2903f02b7495ae2a2009cfbc5bec5885b539f24af351ae00e67b14ed2362d245797fc193ef061eb4084144909dc9398
SSDEEP 49152:AX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQeH5W:AlRsZ47/QXoHUOfAoj1qQ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Detects MeshAgent payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1940876

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\MeshAgent\MeshAgent\Release\MeshService64.pdb

comctl32

InitCommonControlsEx

dbghelp

SymInitialize SymGetModuleBase64 SymGetLineFromAddr64 SymFunctionTableAccess64 SymFromAddr StackWalk64 MiniDumpWriteDump

iphlpapi

GetAdaptersAddresses SendARP ConvertLengthToIpv4Mask GetAdaptersInfo

ws2_32

WSACloseEvent htons htonl gethostname ntohs ntohl WSAGetLastError ioctlsocket recv WSASetLastError send getsockname WSASocketW listen closesocket bind accept __WSAFDIsSet setsockopt socket sendto getsockopt recvfrom connect shutdown WSAIoctl GetAddrInfoW WSAResetEvent WSAEventSelect WSAStartup WSACreateEvent WSACleanup FreeAddrInfoW select

crypt32

CertFindCertificateInStore CertDuplicateCertificateContext CertDeleteCertificateFromStore CryptAcquireCertificatePrivateKey CertAddEncodedCertificateToStore CryptMsgClose CryptMsgUpdate CryptExportPublicKeyInfo CertCreateSelfSignCertificate CertFreeCertificateContext CryptMsgOpenToEncode CertAddCertificateContextToStore PFXExportCertStore CryptSignAndEncodeCertificate CertCloseStore CertStrToNameA CryptMsgGetParam CryptEncodeObject CertSetCertificateContextProperty CertGetCertificateContextProperty CryptMsgCalculateEncodedLength CertOpenStore CertStrToNameW CertEnumCertificatesInStore

gdiplus

GdipGetImageEncoders GdiplusShutdown GdipCloneImage GdipAlloc GdipDisposeImage GdipFree GdipGetImageEncodersSize GdipLoadImageFromStream GdipSaveImageToStream GdiplusStartup

ncrypt

NCryptCreatePersistedKey NCryptFreeObject NCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenRandom NCryptOpenStorageProvider BCryptOpenAlgorithmProvider NCryptFinalizeKey

kernel32

InitializeSListHead GetStartupInfoW RtlUnwindEx GetFullPathNameW GetStdHandle WriteFile LoadLibraryExA GetModuleFileNameW GetSystemPowerStatus OpenProcess MultiByteToWideChar Sleep GetLastError CloseHandle GetCurrentDirectoryW SetCurrentDirectoryW GetProcAddress SetEnvironmentVariableA CreateProcessW FreeLibrary WideCharToMultiByte GetCurrentThreadId GetModuleHandleA WaitForSingleObjectEx CreateThread QueueUserAPC OpenThread ReadFile LoadLibraryA SleepEx SetSystemPowerState GetCurrentProcess SetThreadExecutionState HeapFree HeapAlloc GetProcessHeap SystemTimeToFileTime GetSystemTime FileTimeToSystemTime SystemTimeToTzSpecificLocalTime QueryPerformanceCounter ReleaseSemaphore WaitForSingleObject CreateSemaphoreA CancelIo FindFirstFileW FindNextFileW RemoveDirectoryW GetFinalPathNameByHandleW GetDriveTypeA SetFilePointer FindFirstVolumeA FindClose CreateFileW GetVolumePathNamesForVolumeNameA GetFileAttributesExW ReadDirectoryChangesW FindNextVolumeA FindVolumeClose GetDiskFreeSpaceExA CreateEventA GetModuleHandleExA WaitForMultipleObjectsEx CreateNamedPipeA DisconnectNamedPipe CreateFileA CancelIoEx LocalFree ConnectNamedPipe SetConsoleMode GetConsoleMode SetConsoleOutputCP IsDebuggerPresent TerminateProcess GetTempPathW CancelSynchronousIo SetEvent ResetEvent IsProcessorFeaturePresent GetCurrentProcessId GetEnvironmentStrings FreeEnvironmentStringsA CopyFileW RtlCaptureContext SuspendThread ResumeThread DuplicateHandle GetTickCount64 GetCurrentThread GetOverlappedResult GetThreadContext WTSGetActiveConsoleSessionId GetExitCodeProcess SetEndOfFile DeleteFileW SetFilePointerEx SetConsoleCtrlHandler FreeConsole LoadLibraryExW SetLastError GetFileType GetModuleHandleW SwitchToFiber DeleteFiber CreateFiber GetSystemTimeAsFileTime ConvertFiberToThread ConvertThreadToFiber GetEnvironmentVariableW ReadConsoleA ReadConsoleW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW CreateDirectoryW GetConsoleCP MoveFileExW SetEnvironmentVariableW GetTimeZoneInformation SetStdHandle GetDriveTypeW PeekNamedPipe GetCommandLineA GetCommandLineW GetACP GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetStringTypeW HeapReAlloc FlushFileBuffers WriteConsoleW GetCPInfo FindFirstFileExW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlLookupFunctionEntry GetThreadId RtlVirtualUnwind IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW RaiseException HeapSize RtlPcToFileHeader QueryPerformanceFrequency EncodePointer

user32

EndDialog SetWindowTextW GetWindowPlacement ShowWindow GetDlgCtrlID SetWindowPlacement SetWindowTextA IsDlgButtonChecked GetDlgItem CheckDlgButton DialogBoxParamW EnableWindow MessageBeep ExitWindowsEx GetUserObjectInformationA EnumDisplayMonitors GetSystemMetrics SetThreadDesktop GetThreadDesktop CloseDesktop BlockInput GetMonitorInfoA OpenInputDesktop GetKeyState GetMessageA GetMessageExtraInfo SendMessageW LoadCursorA DestroyWindow GetDC PostMessageA GetIconInfo CallNextHookEx GetCursorInfo SetWindowsHookExA MapVirtualKeyA GetForegroundWindow UnhookWindowsHookEx DefWindowProcA CreateWindowExA TranslateMessage UnregisterClassA DrawIconEx SetWinEventHook RegisterClassExA UnhookWinEvent SetForegroundWindow ReleaseDC SendInput SetProcessDPIAware MessageBoxW GetUserObjectInformationW GetProcessWindowStation DispatchMessageA CreateWindowExW GetWindowRect

gdi32

SetBkMode SetBkColor CreateSolidBrush BitBlt StretchBlt DeleteDC SetStretchBltMode CreateCompatibleBitmap GetObjectA SelectObject CreateCompatibleDC GetDIBits DeleteObject SetTextColor GetStockObject

advapi32

CloseServiceHandle AllocateAndInitializeSid CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource StartServiceCtrlDispatcherA RegCreateKeyW RegSetValueExA RegDeleteKeyA RegCloseKey RegOpenKeyExA OpenProcessToken InitiateSystemShutdownA LookupPrivilegeValueA AdjustTokenPrivileges CryptReleaseContext RegSetValueExW CryptDestroyKey InitializeSecurityDescriptor SetEntriesInAclA SetSecurityDescriptorDacl DuplicateTokenEx CreateProcessAsUserW SetTokenInformation OpenServiceA CheckTokenMembership FreeSid RegisterServiceCtrlHandlerExA OpenSCManagerA SetServiceStatus QueryServiceStatus

shell32

ShellExecuteExW

ole32

CoInitializeEx CreateStreamOnHGlobal CoUninitialize

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

981KB

Virtual Size

981KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

39KB

Virtual Size

201KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

102KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

130KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2024-12-26_20941c81c4583a4059a5124d94e903fd_ismagent_ryuk_sliver

comctl32

dbghelp

iphlpapi

ws2_32

crypt32

gdiplus

ncrypt

kernel32

user32

gdi32

advapi32

shell32

ole32

generic