General

  • Target
    2025-02-21_b49d598df2dd2aed22e4243592b74198_ismagent_ryuk_sliver
  • Size 3.3MB
  • Sample250221-nb29casnv9
  • SHA256 a5cfa3c79e174ceb40a7b838099e6450a8ae9f77bd46cca4a7dfdc8d069008ae
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10

Malware Config

Extracted

Family
  • meshagent

Version
  • 2

Botnet
  • Cyttek

C2
  • http://10.1.1.71:3000/agent.ashx

Attributes
  • mesh_id

    0x33BCBC6EDD36E22F885929FA26B07DE188E576702268A79811892E3F9B38ACC58086A4A60A39F40BD97D1132B8DFD4BB

  • server_id

    52DFECFC819361708A697DA9AE54D91BF4AB2DC28A5983EDF91CD6F4940346582C0CB8B5ED0138A4ED30E687F68C9DEC

  • wss

    wss://10.1.1.71:3000/agent.ashx

Signatures

  • Detects MeshAgent payload 1 IoCs
  • Meshagent family
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • 2025-02-21_b49d598df2dd2aed22e4243592b74198_ismagent_ryuk_sliver
    .exe 3.3MB

2025-02-21_b49d598df2dd2aed22e4243592b74198_ismagent_ryuk_sliver

  • IMPHASH fb0a8b4a81655f744a37af985e009476
  • SHA256 a5cfa3c79e174ceb40a7b838099e6450a8ae9f77bd46cca4a7dfdc8d069008ae
  • MD5 SHA1 SHA512 SSDEEP
  • Detects MeshAgent payload

  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
0
Major OS version
6
Entry point
1940876
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\MeshAgent\MeshAgent\Release\MeshService64.pdb