Extracted

• • Target

    2025-01-15_783c6c51d2ea781d065bea1801241650_ismagent_ryuk_sliver

  • Size

    2.9MB

  • MD5

    783c6c51d2ea781d065bea1801241650

  • SHA1

    cdb67c19a6d4177aa51f3cda66e08026a90e27e6

  • SHA256

    55359047b2ba78d96cf00b4cd57445e7b68e7b0752f42a31805bf94f3f689ebf

  • SHA512

    318daceee5bcfebdf385759ada5eb6aa08189b810c49cb75809b0be16c770d924cd94808fbc011c103616bb3199f6768bf703f6d1128294196b1ff8776e3cf8e

  • SSDEEP

    49152:OiQagHg5EVhwQd+qrW+i1w+Tqc0KxZbDOCwMDbyeKw3FGMFvfjPW21I3iIJS:bg7hRdj9iMlHBSFBWZS

  Score

  10^/10

  meshagentrmmtestbackdoordiscoveryevasionpersistenceprivilege_escalationrattrojan

  • Detects MeshAgent payload

  • MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

    rattrojanbackdoormeshagent

  • Meshagent family

    meshagent

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2