Overview

overview

10

Static

static

10

2025-02-25...er.exe

windows7-x64

1

2025-02-25...er.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-02-25_faf0dc4d8399a41b712d4388842bc620_ismagent_ryuk_sliver

  • Size

    3.3MB

  • Sample

    250225-1r7j8aypw9

  • MD5

    faf0dc4d8399a41b712d4388842bc620

  • SHA1

    12d7c8cfef119109666c7531632399a4bed1025e

  • SHA256

    e844d902296bbe54ed35a5e1ccd072be53153897253d8419966921950f1afc65

  • SHA512

    158f5ba45377ef84e65e3cb1716b1b9d79fb2ce8c887609ecbbac8ed5166237641f750c2ac58fcda2f4b90bb9b6c62dee943d8c3c4bb9c1b20743b41abd58153

  • SSDEEP

    49152:tX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Q3:tlRsZ47/QXoHUOfAoj1x63

Score
10/10
meshagentgerrom

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

Gerrom

C2

http://support.gerrom.com:443/agent.ashx

Attributes
  • mesh_id

    0x690012B4A2F16D8414F000C6C437D320D8AE9EA8B8BE566FCF17AB66ED24769C165272A1ED3F1E5309C2AF4FB6095451

  • server_id

    A25333ADA069FC8958F50A39CBCF9D6FB03D2C984B9C20660196377C1FE4ACD6196BC37E853B20B34BDA7BD227098BD8

  • wss

    wss://support.gerrom.com:443/agent.ashx

Targets

    • Target

      2025-02-25_faf0dc4d8399a41b712d4388842bc620_ismagent_ryuk_sliver

    • Size

      3.3MB

    • MD5

      faf0dc4d8399a41b712d4388842bc620

    • SHA1

      12d7c8cfef119109666c7531632399a4bed1025e

    • SHA256

      e844d902296bbe54ed35a5e1ccd072be53153897253d8419966921950f1afc65

    • SHA512

      158f5ba45377ef84e65e3cb1716b1b9d79fb2ce8c887609ecbbac8ed5166237641f750c2ac58fcda2f4b90bb9b6c62dee943d8c3c4bb9c1b20743b41abd58153

    • SSDEEP

      49152:tX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Q3:tlRsZ47/QXoHUOfAoj1x63

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks