Overview

overview

10

Static

static

10

2025-03-09...er.exe

windows7-x64

1

2025-03-09...er.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-03-09_424c1269887c1f49a2f04b236bdef28f_ismagent_ryuk_sliver

  • Size

    3.3MB

  • Sample

    250309-lheeraztfv

  • MD5

    424c1269887c1f49a2f04b236bdef28f

  • SHA1

    361cf0dd61311563bd62815d44f452876d974968

  • SHA256

    a3a91873d04ab976b6766383e4e0093e04ef53d8404d2b54888967e3fea7d4dc

  • SHA512

    f8a0a32982367843e38d7e19a6fede1ee8709074fb3a12f007502a24d8f37c1024b667fa8f40469acbb25b022e8a2950343f50614fd8bd8d1096d2f0ccdee42c

  • SSDEEP

    49152:HX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85QB:HlRsZ47/QXoHUOfAoj1x6B

Score
10/10
meshagenttacticalrmm

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

TacticalRMM

C2

http://rmm-mesh.wizard.de:443/agent.ashx

Attributes
  • mesh_id

    0xC4D03942BB31E32D70622CCA860FADAE958C7E4FF7DA06F7BAAB47F179910AAB9E7E2752FE8D5B0ECA56F335521FF92D

  • server_id

    4FD9D5847511F651D02FFDF0805C70A57B40A9D2D4A00E53AFBF444F29C7F5653A152E57FB1D9C8AB96F24BC1D71D46C

  • wss

    wss://rmm-mesh.wizard.de:443/agent.ashx

Targets

    • Target

      2025-03-09_424c1269887c1f49a2f04b236bdef28f_ismagent_ryuk_sliver

    • Size

      3.3MB

    • MD5

      424c1269887c1f49a2f04b236bdef28f

    • SHA1

      361cf0dd61311563bd62815d44f452876d974968

    • SHA256

      a3a91873d04ab976b6766383e4e0093e04ef53d8404d2b54888967e3fea7d4dc

    • SHA512

      f8a0a32982367843e38d7e19a6fede1ee8709074fb3a12f007502a24d8f37c1024b667fa8f40469acbb25b022e8a2950343f50614fd8bd8d1096d2f0ccdee42c

    • SSDEEP

      49152:HX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85QB:HlRsZ47/QXoHUOfAoj1x6B

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks