Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

2025-03-14...er.exe

windows7-x64

1

2025-03-14...er.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-03-14_14f18f0f642e57b7184123be58e68858_coinminer_ismagent_ryuk_sliver

  • Size

    3.3MB

  • Sample

    250314-kdsadaw1ew

  • MD5

    14f18f0f642e57b7184123be58e68858

  • SHA1

    fa8ed4e04100cb091228d3c79d7f834ae6277991

  • SHA256

    e7a5b8f23f136868e68a9e46c8843d69e9ba80b0117498c1699e29bdbc81d53f

  • SHA512

    6d6c509ecb973b209f18d5a78ee52a3689526deb1d1ac55ad4cb5cf05cec796ac39c88a36d8612c37183da171612f919324a58db73f2d50287a43fa64eea5470

  • SSDEEP

    49152:MX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Qn:MlRsZ47/QXoHUOfAoj1x6n

Score
10/10
meshagenttacticalrmm

Malware Config

Extracted

Family

meshagent

Version

2

Botnet

TacticalRMM

C2

http://mesh.rmm.donati-group.com:443/agent.ashx

Attributes
  • mesh_id

    0x193AB5E2D9D6C26350F18B8E250DECC3CC4555D96CBCEC3258677265A44FAA96AD5E31175111B35B97419E84437518C4

  • server_id

    43F3556348C2A878F818718C5A668A3FF44AF8C621EAE4714F64FF872617490ACB74A2A239670A417281D3B185DA8A51

  • wss

    wss://mesh.rmm.donati-group.com:443/agent.ashx

Targets

    • Target

      2025-03-14_14f18f0f642e57b7184123be58e68858_coinminer_ismagent_ryuk_sliver

    • Size

      3.3MB

    • MD5

      14f18f0f642e57b7184123be58e68858

    • SHA1

      fa8ed4e04100cb091228d3c79d7f834ae6277991

    • SHA256

      e7a5b8f23f136868e68a9e46c8843d69e9ba80b0117498c1699e29bdbc81d53f

    • SHA512

      6d6c509ecb973b209f18d5a78ee52a3689526deb1d1ac55ad4cb5cf05cec796ac39c88a36d8612c37183da171612f919324a58db73f2d50287a43fa64eea5470

    • SSDEEP

      49152:MX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Qn:MlRsZ47/QXoHUOfAoj1x6n

    Score
    1/10
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks