Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

2025-01-05...er.exe

windows7-x64

1

2025-01-05...er.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-01-05_69564e897fe486790311b78d3405e602_ismagent_ryuk_sliver

  • Size

    3.3MB

  • MD5

    69564e897fe486790311b78d3405e602

  • SHA1

    52a70e1d13e94037043e6f4dc1f4eb8a5912ca4e

  • SHA256

    66f905abe638314a8e7cb7d616d1678d2ee83dd996c298b9f536ef0670d1dc04

  • SHA512

    b72f553aeb7f3fa7af1a69322c32d5854104d3175fdbdd8007f8199abc65bee4b88686d5e45f745a8b244f383841c680b2a854971aa6fbd472bca156b442df75

  • SSDEEP

    49152:cX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Qh:clRsZ47/QXoHUOfAoj1x6h

Score
10/10
famillemeshagent

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

Famille

C2

http://meshcentral.susunnection.be:443/agent.ashx

Attributes
  • mesh_id

    0xA5D514EA066009215CA0DCF767D837B46ACE79EC92F1E9C098B6A04C193D45B60240642311EFEC854C953F62069D8B20

  • server_id

    30441330A74AEA4DC849553A0330F2B0C10AFB8D2DBB79F09C7C7A0319FAB7FF1E6F8BA4B336A8B29E6F338898F35B32

  • wss

    wss://meshcentral.susunnection.be:443/agent.ashx

Signatures

  • Detects MeshAgent payload 1 IoCs
  • Meshagent family
    meshagent
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2025-01-05_69564e897fe486790311b78d3405e602_ismagent_ryuk_sliver
    .exe windows:6 windows x64 arch:x64

    fb0a8b4a81655f744a37af985e009476


    Headers

    Imports

    Sections