Extracted

• • Target

    2025-03-01_f9ffbad54a868dec678f79cc583c5f95_ismagent_ryuk_sliver

  • Size

    2.9MB

  • MD5

    f9ffbad54a868dec678f79cc583c5f95

  • SHA1

    a5c892b1ca7feb7d82c44394dda1eac306e6f674

  • SHA256

    56fbcb8a44a9870fdea8cbe69567220d98f4092cf47d59f450c3f378cb95136d

  • SHA512

    e540eaf2e0257e9be4d0e37f9b04f949d3563af30c5e63c5e332c785410aae30a3999b3b912e6cba458047e41a841b9e49d294792103620ff4c8abe967ea25d8

  • SSDEEP

    49152:1yEEFoRjQ86ctQAWrk9k+PhBFB3FFIBoYCIYSMFvf0VQc9pdQPi:1nj36pUk0TkfYiQ/i

  Score

  10^/10

  meshagenttoruń_biurobackdoordefense_evasiondiscoverypersistenceprivilege_escalationrattrojan

  • Detects MeshAgent payload

  • MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

    rattrojanbackdoormeshagent

  • Meshagent family

    meshagent

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2