MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 06786e9f55e3a7e1f73b015856aeae9f78bb2db6599d526533e9ef81d5441b47. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Meterpreter


Vendor detections: 14


Intelligence 14 IOCs YARA 19 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 06786e9f55e3a7e1f73b015856aeae9f78bb2db6599d526533e9ef81d5441b47
SHA3-384 hash: 7e806576305a6723b989539a757fd4aa56d93ae50e1955d6cd8b463b864720ea888e258377da8a7818956ac6170b424e
SHA1 hash: 5d3dcbfe35ed65387ad3f0b56948eed4e4c6d00e
MD5 hash: ca4bed00dff8074b3098dc5874f93747
humanhash: magazine-helium-papa-lima
File name:diagnostic_tool (2).exe
Download: download sample
Signature Meterpreter
Create hunting rule
File size:245'760 bytes
First seen:2025-08-29 06:38:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash aa02232aac9c62efc63f376bb4772d12 (1 x Meterpreter)
ssdeep 6144:9tB9S9J30n23Ze+TJ5snvHKkVgNhiijciBG:DYIwX0HVgCijci
TLSH T18434480AB761AF66DC454D7B70B270665C10EE188C62DE262F209EF9DA93435AD3F3D0
TrID 41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
26.1% (.EXE) Win64 Executable (generic) (10522/11/4)
12.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.1% (.ICL) Windows Icons Library (generic) (2059/9)
5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter smica83
Tags:exe Meterpreter

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
diagnostic_tool (2).exe
Verdict:
Malicious activity
Analysis date:
2025-08-29 06:41:05 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/aeecdaeb-68ab-40fc-a924-fc732bf2b17a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Meterpreter
Create hunting rule
Link:
https://www.capesandbox.com/analysis/24092/
Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68b14af53e988eb6ab82ea08
Tags:
emotet proxy
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Connection attempt
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug meterpreter obfuscated packed packed packer_detected rozena swrort
Link:
https://www.filescan.io/uploads/68b14af339a6221faa746c57/reports/a64a9b12-8b19-477c-995d-10663a25fa70/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/06786e9f55e3a7e1f73b015856aeae9f78bb2db6599d526533e9ef81d5441b47
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-08-22T11:55:00Z UTC
Last seen:
2025-08-22T11:55:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/06786e9f55e3a7e1f73b015856aeae9f78bb2db6599d526533e9ef81d5441b47/results?tab=lookup
Gathering data
Result
Threat name:
Meterpreter
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1767433
Signature
Contains functionality to inject threads in other processes
Found direct / indirect Syscall (likely to bypass EDR)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Meterpreter
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/06786e9f55e3a7e1f73b015856aeae9f78bb2db6599d526533e9ef81d5441b47
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/06786e9f55e3a7e1f73b015856aeae9f78bb2db6599d526533e9ef81d5441b47/
Threat name:
Win64.Malware.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-08-22 16:40:34 UTC
File Type:
PE+ (Exe)
AV detection:
21 of 36 (58.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=az4g5h2v4ot6d5z3afmfnlvot54lwlnwlgovezjt5hxydvkedndq._file
Verdict:
malicious
Label(s):
metasploit
Create hunting rule
Similar samples:
error
Meterpreter
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/250829-hef8dstjz3/
Behaviour
Legitimate hosting services abused for malware hosting/C2
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/8167df28-d5aa-41f1-8fd2-9545309e44a8
Unpacked files
SH256 hash:
06786e9f55e3a7e1f73b015856aeae9f78bb2db6599d526533e9ef81d5441b47
MD5 hash:
ca4bed00dff8074b3098dc5874f93747
SHA1 hash:
5d3dcbfe35ed65387ad3f0b56948eed4e4c6d00e
Link:
https://www.unpac.me/results/94eae36e-ab9f-47e2-8a72-0b8b3f49ef59/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.19
Link:
https://yomi.yoroi.company/submissions/06786e9f55e3a7e1f73b015856aeae9f78bb2db6599d526533e9ef81d5441b47

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT_Lazarus_Loader_Dec_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect loader used by Lazarus group in december 2020
Reference:Internal Research
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MALWARE_Win_Meterpreter
Create hunting rule
Author:ditekSHen
Description:Detects Meterpreter payload
Rule name:meth_peb_parsing
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:SUSP_Ngrok_URL
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects a PE file that contains an ngrok.io URL. This can be used as C2 channel
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:Windows_Trojan_Metasploit_38b8ceec
Create hunting rule
Description:Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon).
Rule name:Windows_Trojan_Metasploit_7bc0f998
Create hunting rule
Description:Identifies the API address lookup function leverage by metasploit shellcode
Rule name:Windows_Trojan_Metasploit_c9773203
Create hunting rule
Description:Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/24092/

Comments