Overview

overview

10

Static

static

10

2025-01-03...er.exe

windows7-x64

1

2025-01-03...er.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-01-03_947a7a3ebd3c5c43cf759350457987f5_ismagent_ryuk_sliver

  • Size

    3.2MB

  • Sample

    250103-mje84s1qam

  • MD5

    947a7a3ebd3c5c43cf759350457987f5

  • SHA1

    303aa4f0236df4e8cb98756d3eb05286d6bb7404

  • SHA256

    633741540b9a55e62c790ae1c2d729963d5f76065882d1265fa6946c888746d4

  • SHA512

    66367e255b7cc5621dea8578db39516426c98a9a496931911921c88fdbe703a57b84ec2e81eba32461d7cfea5cc856cc36facb7b1a71fd29ab1e1b8e113e68dc

  • SSDEEP

    49152:EX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQet:ElRsZ47/QXoHUOfAoj1u

Score
10/10
meshagentrobbin

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

robbin

C2

http://172.232.102.54:443/agent.ashx

Attributes
  • mesh_id

    0xF843C931D6D41192A06910CD216CBBC848B2593C2F62DE60305D39252F33789BCA17507D0ABB84DD3BE615F729B33938

  • server_id

    6BE103485BAC23D50467F1CF77DC0C324944B61664D5F0DBF5AD40BFF7083CCAFC5ECF27219AEDD7E61E561F6EC0267E

  • wss

    wss://172.232.102.54:443/agent.ashx

Targets

    • Target

      2025-01-03_947a7a3ebd3c5c43cf759350457987f5_ismagent_ryuk_sliver

    • Size

      3.2MB

    • MD5

      947a7a3ebd3c5c43cf759350457987f5

    • SHA1

      303aa4f0236df4e8cb98756d3eb05286d6bb7404

    • SHA256

      633741540b9a55e62c790ae1c2d729963d5f76065882d1265fa6946c888746d4

    • SHA512

      66367e255b7cc5621dea8578db39516426c98a9a496931911921c88fdbe703a57b84ec2e81eba32461d7cfea5cc856cc36facb7b1a71fd29ab1e1b8e113e68dc

    • SSDEEP

      49152:EX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQet:ElRsZ47/QXoHUOfAoj1u

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks