Overview

overview

10

Static

static

10

2025-02-18...er.exe

windows7-x64

1

2025-02-18...er.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-02-18_f25424cf81e3d5065d3a7546798a702b_ismagent_ryuk_sliver

  • Size

    3.3MB

  • Sample

    250218-c1ph1axmw5

  • MD5

    f25424cf81e3d5065d3a7546798a702b

  • SHA1

    afe2af23b81c0611af12fb869c4880fca68f3c9e

  • SHA256

    11a795016db3621248bd5026ea606b21da89236c8d15a2fca877f989eff131d3

  • SHA512

    a8989c012a9011e8e2f15224bf1021dbc1e212605c3167ecdd80ac1d15caca4f5d7ddfee3791c19ea615333b24fe58802941f4a01d9bcfbf9c7f46fe006305ae

  • SSDEEP

    49152:dX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Qw:dlRsZ47/QXoHUOfAoj1x6w

Score
10/10
meshagentbentwood

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

BENTWOOD

C2

http://itdobro.ru:443/agent.ashx

Attributes
  • mesh_id

    0xBB112163C71F641E084C3263DB40925C97B027ABC751FE1DCB436E463536E6CC0B85E65077763F27673B0C4BB4FD8778

  • server_id

    790FFF105FCF9D4DA0A56EA117C7C6BF3DF2FCF0E0FA67C7B77C741E21538E85E6B431F13C8E9C558C855A607F929FBA

  • wss

    wss://itdobro.ru:443/agent.ashx

Targets

    • Target

      2025-02-18_f25424cf81e3d5065d3a7546798a702b_ismagent_ryuk_sliver

    • Size

      3.3MB

    • MD5

      f25424cf81e3d5065d3a7546798a702b

    • SHA1

      afe2af23b81c0611af12fb869c4880fca68f3c9e

    • SHA256

      11a795016db3621248bd5026ea606b21da89236c8d15a2fca877f989eff131d3

    • SHA512

      a8989c012a9011e8e2f15224bf1021dbc1e212605c3167ecdd80ac1d15caca4f5d7ddfee3791c19ea615333b24fe58802941f4a01d9bcfbf9c7f46fe006305ae

    • SSDEEP

      49152:dX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Qw:dlRsZ47/QXoHUOfAoj1x6w

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks