Extracted

• • Target

    2025-03-07_38700b6ebb30b54827ce7d266dbe5791_ismagent_ryuk_sliver

  • Size

    2.9MB

  • MD5

    38700b6ebb30b54827ce7d266dbe5791

  • SHA1

    14f3f6d8fab9e6cca292d97b50c0c1738c4105b5

  • SHA256

    048c1d253ea91dac38e701c6fdcb083a3979681fd01e2b04c2a82fc0c9e4a988

  • SHA512

    310d177a3842ef54b1cff6e751d889904d90c3382b43a1f1ef7424cea9dbc5444a653e2c390d297894760503df6d48cc5fcdb0619ced8d7bad71b76ed2a62a22

  • SSDEEP

    49152:xZFIlmhRYg1OziGQGRCv6da/KMvxZdAMBwQoxXXujOl4MPMFvfldPSFrXxn3P:el7i86hR+fWMeP43P

  Score

  10^/10

  meshagenttacticalrmmbackdoordefense_evasiondiscoverypersistenceprivilege_escalationrattrojan

  • Detects MeshAgent payload

  • MeshAgent

    MeshAgent is an open source remote access trojan written in C++.

    rattrojanbackdoormeshagent

  • Meshagent family

    meshagent

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2