Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2025-02-06_475644bf641ac938607df3084c2678cb_ismagent_ryuk_sliver

  • Size

    3.3MB

  • MD5

    475644bf641ac938607df3084c2678cb

  • SHA1

    76bafd72b92d6e2b2e21c03713c5957fc3239d1a

  • SHA256

    efbdc6ede18dca62fd9f607ec184a9f8ccc598bc79a330114f0194c75e96aed0

  • SHA512

    9ea5a4cadab8a5c16fae256f1b5813ea4d20b5a772ce449384059b706f75d358f8f9cab4bab820dd0c7716cf6585c03a3825196ab02868328d4d448b2b65d2b4

  • SSDEEP

    49152:aX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85QO:alRsZ47/QXoHUOfAoj1x6O

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

All-New-Agents

C2

http://remote.call.guru:443/chris/agent.ashx

Attributes
  • mesh_id

    0x10B76141D910B3DDDA43A24CC5FF13AEAE6B0D51BB73E4B8C7BF539C6F510491AE93FD72165E6C060C7A410EA7B8FF74

  • server_id

    64A8AB991761EA57A393222F8F817F115F14B0E44749007ABBEFF8A34DABD16071375F7A7899CFFC0E63750D0C65CF30

  • wss

    wss://remote.call.guru:443/chris/agent.ashx

Signatures

  • Detects MeshAgent payload 1 IoCs
  • Meshagent family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 2025-02-06_475644bf641ac938607df3084c2678cb_ismagent_ryuk_sliver
    .exe windows:6 windows x64 arch:x64

    fb0a8b4a81655f744a37af985e009476


    Headers

    Imports

    Sections