MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 075408addac617e1bbf9533c8eb42a57d9afeb841896485998c6d451d1425556. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Metasploit

Vendor detections: 14

Intelligence 14 IOCs YARA 7 File information Comments 1

SHA256 hash:	075408addac617e1bbf9533c8eb42a57d9afeb841896485998c6d451d1425556
SHA3-384 hash:	fc2be667e8afad37eb0b478a587ebd066f9ec2b100e5efd040c26d469a661a443228cd230198d4c845d88a5bee8bb471
SHA1 hash:	9a503bc2e6d9e8564d8fc8d1232110bbfef1bc4b
MD5 hash:	6020803dbb6bab94e7a8ade80c923cd8
humanhash:	burger-jig-massachusetts-football
File name:	6020803dbb6bab94e7a8ade80c923cd8
Download:	download sample
Signature	Metasploit Create hunting rule
File size:	73'802 bytes
First seen:	2024-10-07 20:22:54 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	481f47bbb2c9c21e108d65f52b04c448 (257 x Meterpreter, 93 x Metasploit, 33 x ShikataGaNai)
ssdeep	1536:IIRnw+slH+WMASb1JNVh/E6UM8HMmodMb+KR0Nc8QsJq39:hqeWBA1H/ZUM8Hsde0Nc8QsC9
TLSH	T1AC73B043EAC42425C6A7123D67763A755971F5FA3305C09A7A8CCEE5EBD1CB0913A3C2
TrID	37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 12.7% (.EXE) Win64 Executable (generic) (10523/12/4) 7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
Reporter	zbetcheckin
Tags:	32 exe Metasploit

Intelligence

File Origin

# of uploads :

# of downloads :

366

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

6020803dbb6bab94e7a8ade80c923cd8

Verdict:

Malicious activity

Analysis date:

2024-10-07 20:29:58 UTC

Tags:

metasploit

Link:

https://app.any.run/tasks/6e6e442c-dc11-4f44-a5b2-17511749f283

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Trojan.Swrort-5710536-0

BC.Win.Trojan.Swrort-17210

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6704432ea69182ddbe5ccc64

Tags:

Cobaltstrike Cobalt Rozena

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

cobalt lolbin microsoft_visual_cc overlay packed remote

Link:

https://www.filescan.io/uploads/6704432bd92ce92b9f9b616a/reports/4a0ad932-070b-42c6-97a3-e9e28bae518c/overview

Verdict:

Malicious

Labled as:

Trojan.CryptZ.Marte.1

Link:

https://www.hybrid-analysis.com/sample/075408addac617e1bbf9533c8eb42a57d9afeb841896485998c6d451d1425556

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/d77d70da-cd6e-46aa-a626-fbc82fc9b4c9

Result

Threat name:

Metasploit

Detection:

malicious

Classification:

troj

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1528421

Signature

AI detected suspicious sample

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Metasploit Payload

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/075408addac617e1bbf9533c8eb42a57d9afeb841896485998c6d451d1425556

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/075408addac617e1bbf9533c8eb42a57d9afeb841896485998c6d451d1425556/

Threat name:

Win32.Backdoor.Swrort

Status:

Malicious

First seen:

2024-10-05 00:32:48 UTC

File Type:

PE (Exe)

AV detection:

36 of 38 (94.74%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=a5karlo2yyl6do7zkm6i5nbkk7m2724edcleqwmyy3kfdukckvla._file

Result

Malware family:

metasploit

Score:

10/10

Tags:

family:metasploit backdoor discovery trojan

Link:

https://tria.ge/reports/241007-y5577ssfpq/

Behaviour

System Location Discovery: System Language Discovery

MetaSploit

Malware Config

C2 Extraction:

http://89.197.154.116:7810/yTHhXb9uKTVtHGwdC-KhsgWbOZaN3HxidwX14UcC9cvoELjOGQD

Verdict:

Malicious

Tags:

red_team_tool metasploit cobalt_strike

YARA:

CobaltStrike_Resources_Httpsstager_Bin_v2_5_through_v4_x CobaltStrikeStager Windows_Trojan_Metasploit_24338919 Cobalt_functions

Link:

https://app.threat.zone/submission/e8b285d2-f78a-4ab3-819b-75c5305cc982

Unpacked files

SH256 hash:

075408addac617e1bbf9533c8eb42a57d9afeb841896485998c6d451d1425556

MD5 hash:

6020803dbb6bab94e7a8ade80c923cd8

SHA1 hash:

9a503bc2e6d9e8564d8fc8d1232110bbfef1bc4b

Detections:

SUSP_Imphash_Mar23_2

CobaltStrike_Resources_Httpsstager_Bin_v2_5_through_v4_x

Link:

https://www.unpac.me/results/ed489ad6-5b21-4794-9cb9-f351114363f8/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.56

Link:

https://yomi.yoroi.company/submissions/075408addac617e1bbf9533c8eb42a57d9afeb841896485998c6d451d1425556

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CobaltStrikeStager Create hunting rule
Author:	@dan__mayer <daniel@stairwell.com>
Description:	Cobalt Strike Stager Payload

Rule name:	CobaltStrike_Resources_Httpsstager_Bin_v2_5_through_v4_x Create hunting rule
Author:	gssincla@google.com
Description:	Cobalt Strike's resources/httpsstager.bin signature for versions 2.5 to 4.x
Reference:	https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse

Rule name:	CobaltStrike__Resources_Httpsstager_Bin_v2_5_through_v4_x Create hunting rule
Author:	gssincla@google.com

Rule name:	Detect_Malicious_VBScript_Base64 Create hunting rule
Author:	daniyyell
Description:	Detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell.

Rule name:	meth_peb_parsing Create hunting rule
Author:	Willi Ballenthin

Rule name:	SUSP_Imphash_Mar23_2 Create hunting rule
Author:	Arnim Rupp (https://github.com/ruppde)
Description:	Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)
Reference:	Internal Research

Rule name:	Windows_Trojan_Metasploit_24338919 Create hunting rule
Author:	Elastic Security
Description:	Identifies metasploit wininet reverse shellcode. Also used by other tools (like beacon).

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Metasploit

exe 075408addac617e1bbf9533c8eb42a57d9afeb841896485998c6d451d1425556

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/3223220/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	ADVAPI32.dll::AllocateAndInitializeSid ADVAPI32.dll::FreeSid
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::SetStdHandle
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateFileA KERNEL32.dll::CreateFileW
WIN_SOCK_API	Uses Network to send and receive data	WS2_32.dll::WSARecv WS2_32.dll::WSASend

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2024-10-07 20:22:55 UTC

url : hxxp://89.197.154.116/Excel-hxxps.exe