MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c5b1a5d5b899a02b00afe8d883bc6fbd2b0bf26d249e5180d860874560eeb49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Meterpreter

Vendor detections: 15

Intelligence 15 IOCs YARA 22 File information Comments

SHA256 hash:	0c5b1a5d5b899a02b00afe8d883bc6fbd2b0bf26d249e5180d860874560eeb49
SHA3-384 hash:	cdb14904256fe56d45238f59c0c0f28c8ec0787ab2289f9e956c4c26eedb5027f4e85114fba2c39dda4cde69cd818037
SHA1 hash:	c41c269897594fa4c4d13858054dfb7b6468fc6f
MD5 hash:	8d7879e80d8852b4b1f1d27b76670677
humanhash:	harry-five-nitrogen-august
File name:	meter.exe
Download:	download sample
Signature	Meterpreter Create hunting rule
File size:	203'776 bytes
First seen:	2026-09-25 19:20:43 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	c2d02fc98f1d75d7b9457468ec75da0e (28 x Meterpreter, 3 x Metasploit)
ssdeep	3072:tUqkdvHJexJb8eox+J51VCxelW7gFhyMw1J+yJDXqa6vbJxlN3w8nASbEWKRUjHj:eqkdmJwegYFRw1lXqa4Lw8xFFjkM
TLSH	T17B148C02B8C28072D5BF0534057A9F221FFD7C202BB99DEB57684CA90E755C1E735BAA
TrID	50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 10.5% (.EXE) Win64 Executable (generic) (6522/11/2) 8.1% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	BlinkzSec
Tags:	Meterpreter

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/a26dd025-ea13-4a46-9aac-c7f885901b80/

Malware family:

mimikatz

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-09-25 19:32:04 UTC

Tags:

backdoor metasploit mimikatz tool

Link:

https://app.any.run/tasks/10d359b0-65a4-4311-bf60-43c12a5c622e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Meterpreter

Link:

https://www.capesandbox.com/analysis/89028/

Detection(s):

Win.Exploit.D388a-9756522-0

Win.Exploit.Meterpreter-9777172-0

YARA.DITEKSHEN_MALWARE_Win_Meterpreter.UNOFFICIAL

SecuriteInfo.com.Trojan.Inject6.5094.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Sending a custom TCP request

Launching a service

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

crypto exploit microsoft_visual_cc packed

Link:

https://www.filescan.io/uploads/6ab6cbccb231515463a018d3/reports/6c6fd982-cbcd-44a2-aafb-5eafd9d931f4/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/0c5b1a5d5b899a02b00afe8d883bc6fbd2b0bf26d249e5180d860874560eeb49

Malware family:

Metasploit Framework

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/bcf6b6d6-7220-49fa-9a50-9ba538b9a938

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/0c5b1a5d5b899a02b00afe8d883bc6fbd2b0bf26d249e5180d860874560eeb49

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/8d7879e80d8852b4b1f1d27b76670677

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0c5b1a5d5b899a02b00afe8d883bc6fbd2b0bf26d249e5180d860874560eeb49/

Threat name:

Win32.Malware.Heuristic

Status:

Malicious

First seen:

2026-09-25 19:18:15 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

25 of 36 (69.44%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=brnruxk3rgnafmak72gyqo6g7pjlbpzg2je6kganqyehivqo5neq._file

Verdict:

malicious

Label(s):

Metasploit

Link:

https://reports.threatray.com/83a77cf4-b85d-4f26-ae2e-30e428a3ab18

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/260925-x2r1qsvdjb/

Behaviour

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Unpacked files

SH256 hash:

0c5b1a5d5b899a02b00afe8d883bc6fbd2b0bf26d249e5180d860874560eeb49

MD5 hash:

8d7879e80d8852b4b1f1d27b76670677

SHA1 hash:

c41c269897594fa4c4d13858054dfb7b6468fc6f

Detections:

triage_cobaltstrike_sc_rot13

triage_meterpreter

Link:

https://www.unpac.me/results/23fd106d-d5af-459d-94bd-287e393f02fe/

SH256 hash:

f63ffe1ddf8d003d2d6f6fec76b03a9eadd994f6c9eec3d266b1743900650d26

MD5 hash:

75f98162e81f1e4b5045618e29b81767

SHA1 hash:

f6375db3acedd008273cf11131c07688eedf2584

Detections:

triage_cobaltstrike_sc_rot13

triage_meterpreter

MALWARE_Win_Meterpreter

Link:

https://www.unpac.me/results/23fd106d-d5af-459d-94bd-287e393f02fe/

Parent samples :

a6e39681022ab25930d86064c933d3dece895e90a76ed83a3bbeb1e0ac83270b
0c5b1a5d5b899a02b00afe8d883bc6fbd2b0bf26d249e5180d860874560eeb49

Malware family:

Metasploit

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0c5b1a5d5b89/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	lsadump Create hunting rule
Author:	Benjamin DELPY (gentilkiwi)
Description:	LSA dump programe (bootkey/syskey) – pwdump and others

Rule name:	MALWARE_Win_Meterpreter Create hunting rule
Author:	ditekSHen
Description:	Detects Meterpreter payload

Rule name:	meth_peb_parsing Create hunting rule
Author:	Willi Ballenthin

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	Windows_Trojan_Metasploit_0cc81460 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Metasploit_38b8ceec Create hunting rule
Description:	Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon).

Rule name:	Windows_Trojan_Metasploit_38b8ceec Create hunting rule
Author:	Elastic Security
Description:	Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon).

Rule name:	Windows_Trojan_Metasploit_7bc0f998 Create hunting rule
Description:	Identifies the API address lookup function leverage by metasploit shellcode

Rule name:	Windows_Trojan_Metasploit_7bc0f998 Create hunting rule
Author:	Elastic Security
Description:	Identifies the API address lookup function leverage by metasploit shellcode

Rule name:	Windows_Trojan_Metasploit_c9773203 Create hunting rule
Description:	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:	https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm

Rule name:	Windows_Trojan_Metasploit_c9773203 Create hunting rule
Author:	Elastic Security
Description:	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:	https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm