Overview

overview

10

Static

static

10

2025-01-07...er.exe

windows7-x64

1

2025-01-07...er.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-01-07_292f6465443b571d4bc2e4bf4632d81f_ismagent_ryuk_sliver

  • Size

    3.3MB

  • Sample

    250107-x272ysvmax

  • MD5

    292f6465443b571d4bc2e4bf4632d81f

  • SHA1

    ea55a5a7b51f73d6512475eaa2595ec6049d13d0

  • SHA256

    80312eee49296842843d3bccaf75e582787ffc0df6e20506d865cb1acd208bb0

  • SHA512

    af66cb6692754b49d8136fb3011428c3a06f8490180ae788f64a62f44b5fb71b749eefcda71ca8a8e489b0b5b8ab722095c8d177efd5209531985a21fb9e28d8

  • SSDEEP

    49152:ZX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Q4:ZlRsZ47/QXoHUOfAoj1x64

Score
10/10
meshagenttacticalrmm

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

TacticalRMM

C2

http://mesh.rmmservice.online:443/agent.ashx

Attributes
  • mesh_id

    0xAE38B56FE5183C95ADB07E891AD8C1C875E7581CB4F18F66A3BDF6293D5AB0BF54C7F59A587CE8C236B5AB83D5F1FE72

  • server_id

    8D7E9649F99921AADA99C414479CE22D769C60DDA552DF23909CF057ADE4C28BD1C47DA14337E201B549FA3540B5705F

  • wss

    wss://mesh.rmmservice.online:443/agent.ashx

Targets

    • Target

      2025-01-07_292f6465443b571d4bc2e4bf4632d81f_ismagent_ryuk_sliver

    • Size

      3.3MB

    • MD5

      292f6465443b571d4bc2e4bf4632d81f

    • SHA1

      ea55a5a7b51f73d6512475eaa2595ec6049d13d0

    • SHA256

      80312eee49296842843d3bccaf75e582787ffc0df6e20506d865cb1acd208bb0

    • SHA512

      af66cb6692754b49d8136fb3011428c3a06f8490180ae788f64a62f44b5fb71b749eefcda71ca8a8e489b0b5b8ab722095c8d177efd5209531985a21fb9e28d8

    • SSDEEP

      49152:ZX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Q4:ZlRsZ47/QXoHUOfAoj1x64

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks