Overview

overview

10

Static

static

10

2025-02-06...er.exe

windows7-x64

1

2025-02-06...er.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-02-06_f837d70efebadf961b7f93bc0434b673_ismagent_ryuk_sliver

  • Size

    3.3MB

  • Sample

    250206-v155vs1pfs

  • MD5

    f837d70efebadf961b7f93bc0434b673

  • SHA1

    370a807b57a7932e4c9734ae8e12f5d40f45f715

  • SHA256

    7978e7f143a9082ffb817b4d33b02209a437388f429989fd1cdbe0905a5a3261

  • SHA512

    afff58ac3cd23342aa78a2203aca7aa259de8cf2262055ae5e2ff4945589297e6f63a4da29aaf2f8bae72e23242bbd9e986bf372ee53f69a2ec607161f612102

  • SSDEEP

    49152:kX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85QF:klRsZ47/QXoHUOfAoj1x6F

Score
10/10
meshagentterner_xray

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

terner_xray

C2

http://198.175.124.228:443/agent.ashx

Attributes
  • mesh_id

    0x74D606EB9E06B67D2DBE78DCA2155FAE8AD52A38A7A675B5AB8B50EDEC343E3980A404648D51DDFEF4D752821AE97D72

  • server_id

    620BC47E4DFC968D6B5A2D131D581C16D8EBF316E4CDACD591D2BB8CF7C1FF2046B96E2E499939A682A41A2602EB42D9

  • wss

    wss://198.175.124.228:443/agent.ashx

Targets

    • Target

      2025-02-06_f837d70efebadf961b7f93bc0434b673_ismagent_ryuk_sliver

    • Size

      3.3MB

    • MD5

      f837d70efebadf961b7f93bc0434b673

    • SHA1

      370a807b57a7932e4c9734ae8e12f5d40f45f715

    • SHA256

      7978e7f143a9082ffb817b4d33b02209a437388f429989fd1cdbe0905a5a3261

    • SHA512

      afff58ac3cd23342aa78a2203aca7aa259de8cf2262055ae5e2ff4945589297e6f63a4da29aaf2f8bae72e23242bbd9e986bf372ee53f69a2ec607161f612102

    • SSDEEP

      49152:kX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85QF:klRsZ47/QXoHUOfAoj1x6F

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks