MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8ef279b191d3e0024ef332f5e12033f889566205f77c5ab700c9b41795fb0343. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Metasploit

Vendor detections: 10

Intelligence 10 IOCs YARA 5 File information Comments

SHA256 hash:	8ef279b191d3e0024ef332f5e12033f889566205f77c5ab700c9b41795fb0343
SHA3-384 hash:	4cb5db4a322c2dcd18806d5d13902bf3823794d781f839d132b326b33f5bf910b05516ac89b654cc6491da14973214fa
SHA1 hash:	8e86f00a763848a700a81542ca877bbbd790eb7e
MD5 hash:	b233e282903a8868b63d0b1ca8f99388
humanhash:	berlin-kentucky-thirteen-fillet
File name:	file
Download:	download sample
Signature	Metasploit Create hunting rule
File size:	7'168 bytes
First seen:	2022-10-29 20:29:06 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b4c6fff030479aa3b12625be67bf4914 (122 x Meterpreter, 16 x Metasploit, 4 x CobaltStrike)
ssdeep	24:eFGStrJ9u0/6oxnZdkBQAVtYLwKtRqVeNDMSCvOXpmB:is0NBkBQtLwKsSD9C2kB
Threatray	17 similar samples on MalwareBazaar
TLSH	T1ECE1752337189EB6D87D057D46E3BCA7B1588E383F3B43B289280307396212879F0A44
TrID	45.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.3% (.EXE) OS/2 Executable (generic) (2029/13) 18.0% (.EXE) Generic Win/DOS Executable (2002/3) 18.0% (.EXE) DOS Executable Generic (2000/1)
Reporter	jstrosch
Tags:	exe Metasploit

Intelligence

File Origin

# of uploads :

# of downloads :

924

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

file

Verdict:

No threats detected

Analysis date:

2022-10-29 20:29:51 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/45e1ebf7-b5c9-423d-ad38-af6dabaf41ad

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/325970/

Detection(s):

SecuriteInfo.com.Crypt_r.AKH.14258.12458.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a file in the system32 subdirectories

Creating a file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

cobalt packed

Link:

https://www.filescan.io/uploads/635d8d4b00b65b1cd8a80387/reports/57767e60-4e82-49a8-b0f3-956998b1bf8b/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/edf40b46-9735-467e-8a35-b59e427a2e46

Result

Threat name:

Metasploit

Detection:

malicious

Classification:

troj

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1101058

Signature

Antivirus / Scanner detection for submitted sample

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Metasploit Payload

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8ef279b191d3e0024ef332f5e12033f889566205f77c5ab700c9b41795fb0343/

Threat name:

Win64.Backdoor.Meterpreter

Status:

Malicious

First seen:

2022-10-29 06:08:16 UTC

File Type:

PE+ (Exe)

AV detection:

23 of 26 (88.46%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=r3zhtmmr2pqaetxtgl26cibt7cevmyqf656fvnyazg2bpfp3anbq._file

Verdict:

malicious

Metasploit

36e8d288cd4ed8be82d462513431c2b6fc216f0295699d880a949324e581c138

Metasploit

80210a2668263036c7e6b1f8690ebf74e5b0824d26b44040f069fdfd14df1480

Metasploit

a3b14096156684a6aed44851c7c9d1fbe64e7926cbdf57317f083f0ca1ae4d06

Metasploit

b03e97cdc9f9ba9f3309b22346ae26863b234181bfc400c06d35de19cdb220e0

Metasploit

eaf6bec10dafecc0c999b39058d97d716403acf7ee9fd914740807554f8cafde

Metasploit

f988cdf69822247eb38f7ef3afef5fbb39f506ca0730b3df815f42c40f67f31a

Metasploit

fd280b46b65ccc2d32b8889e0ab35155c22c428a7ed4e96b7a3588410ba9f4e8

Metasploit

+ 7 additional samples on MalwareBazaar

Result

Malware family:

metasploit

Score:

10/10

Tags:

family:metasploit backdoor trojan

Link:

https://tria.ge/reports/221029-y95ggaeegr/

Behaviour

MetaSploit

Malware Config

C2 Extraction:

192.168.244.142:4444

Unpacked files

SH256 hash:

8ef279b191d3e0024ef332f5e12033f889566205f77c5ab700c9b41795fb0343

MD5 hash:

b233e282903a8868b63d0b1ca8f99388

SHA1 hash:

8e86f00a763848a700a81542ca877bbbd790eb7e

Link:

https://www.unpac.me/results/a1d2ff5e-4a87-4fce-9ab1-b547d0d7eb1a/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/8ef279b191d3e0024ef332f5e12033f889566205f77c5ab700c9b41795fb0343

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	metasploit_rev_tcp_64 Create hunting rule
Author:	Javier Rascon

Rule name:	meth_peb_parsing Create hunting rule
Author:	Willi Ballenthin

Rule name:	Windows_Trojan_Metasploit_66140f58 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Metasploit_91bc5d7d Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Metasploit_c9773203 Create hunting rule
Author:	Elastic Security
Description:	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:	https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm