Extracted

• • Target

    2025-01-28_8cd4a310e3c4f2ce52250eca4f2c630f_ismagent_ryuk_sliver

  • Size

    2.9MB

  • MD5

    8cd4a310e3c4f2ce52250eca4f2c630f

  • SHA1

    2af4e53f40b5b28613d35c82b9768bc78d2fad56

  • SHA256

    aa89ac89659bffee9a9e8125f67df0c41ded196e282bcd9aa40bb703637a2527

  • SHA512

    3dcae80f39b429085d4b44aad6b3108e665a6d25e74694ef6730d171866abff60c55e7b4cb31f9520f8d825b041ddc7648aeac2977027bf4d4eb482567ef10d8

  • SSDEEP

    49152:kZFIlmhRYg1OziGQGRCv6da/KMvxZdAMBwQoxXXujOl4MPMFvfldPSFrXxn3l:jl7i86hR+fWMeP43l

  Score

  10^/10

  meshagent050 lisboa - zonesoftbackdoordefense_evasiondiscoverypersistenceprivilege_escalationrattrojan

  • Detects MeshAgent payload

  • MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

    rattrojanbackdoormeshagent

  • Meshagent family

    meshagent

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2