MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 12a5d1fb7696d10b4088b5f3d3b1b4444eea5346f7fdc509dad9eda48a8db2f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Meterpreter


Vendor detections: 11


Intelligence 11 IOCs YARA 20 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 12a5d1fb7696d10b4088b5f3d3b1b4444eea5346f7fdc509dad9eda48a8db2f5
SHA3-384 hash: f99e7333ee75b6e8a039f7d128831da0aad6010f04b225cd9d4de9de7dab411b6e3ef8bcde76a19f52b5e8957381237e
SHA1 hash: 888e7d1f6a46ee261196ffcca1ad42fb533ecad7
MD5 hash: 1e86c07a6a1fd6c9326ec6b2b2492ea6
humanhash: oregon-burger-lemon-artist
File name:1e86c07a6a1fd6c9326ec6b2b2492ea6.exe
Download: download sample
Signature Meterpreter
Create hunting rule
File size:1'698'304 bytes
First seen:2023-10-31 09:25:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d45317193763b38bee079b79bd430ddd (1 x Meterpreter)
ssdeep 24576:5lw0N6i6kL9yHr0CzKyvWIigZIRWHFjAbMbGIhLqBh3SWgSklWEG3c:56OMke0CH1vCsF8whqBST1WEd
TLSH T14E759E52F29140F2D659547754AA673DDAB09F5F0B22CBC39313FD286C329E0EA2B12D
TrID 21.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
18.3% (.EXE) UPX compressed Win32 Executable (27066/9/6)
18.0% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
11.2% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
8.9% (.SCR) Windows screen saver (13097/50/3)
File icon (PE):PE icon
dhash icon 134c6c6d4d5ddc23 (1 x Meterpreter)
Reporter abuse_ch
Tags:exe Meterpreter


Avatar
abuse_ch
Meterpreter C2:
103.102.5.180:443

Intelligence

File Origin
# of uploads :
1
# of downloads :
359
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/457333/
Detection(s):
Win.Malware.Confidence-6629254-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
DNS request
Sending a custom TCP request
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control greyware hacktool keylogger lolbin packed shell32
Link:
https://www.filescan.io/uploads/6540c82abc703e36b094cd01/reports/1fdc936c-bd65-400e-88f6-de260b488881/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/12a5d1fb7696d10b4088b5f3d3b1b4444eea5346f7fdc509dad9eda48a8db2f5
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
KRBanker
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5caf78db-253a-43ee-83b7-54bc60e2ec8b
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.spyw.evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1334781
Signature
Contains functionality to detect sleep reduction / modifications
Contains functionality to modify clipboard data
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Uses dynamic DNS services
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/12a5d1fb7696d10b4088b5f3d3b1b4444eea5346f7fdc509dad9eda48a8db2f5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/12a5d1fb7696d10b4088b5f3d3b1b4444eea5346f7fdc509dad9eda48a8db2f5/
Threat name:
Win32.Backdoor.Meterpreter
Create hunting rule
Status:
Malicious
First seen:
2023-10-22 13:17:00 UTC
File Type:
PE (Exe)
Extracted files:
58
AV detection:
19 of 38 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cks5d63ws3iqwqeiwxz5hmnuirhouu2g6764kco23hw2jcunwl2q._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  7/10
Tags:
upx
Link:
https://tria.ge/reports/231031-ld6y7shb35/
Behaviour
Suspicious use of SetWindowsHookEx
UPX packed file
Unpacked files
SH256 hash:
860e94a27a2dc15157884991d8d99b97303965e9891c7f92d1b08ffe0c3af067
MD5 hash:
251bc5fef9d5335fc29c1ffa0a7b79e8
SHA1 hash:
b6407f2632bf3f98dfb9aa205264a536ea368cba
Link:
https://www.unpac.me/results/de1f5379-9417-4cbc-8884-c7f0a5f77b1c/
SH256 hash:
12a5d1fb7696d10b4088b5f3d3b1b4444eea5346f7fdc509dad9eda48a8db2f5
MD5 hash:
1e86c07a6a1fd6c9326ec6b2b2492ea6
SHA1 hash:
888e7d1f6a46ee261196ffcca1ad42fb533ecad7
Detections:
win_xiaoba_auto
Create hunting rule
Link:
https://www.unpac.me/results/de1f5379-9417-4cbc-8884-c7f0a5f77b1c/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Chinese_Hacktool_1014
Create hunting rule
Author:Florian Roth
Description:Detects a chinese hacktool with unknown use
Rule name:Chinese_Hacktool_1014
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a chinese hacktool with unknown use
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:lsadump
Create hunting rule
Author:Benjamin DELPY (gentilkiwi)
Description:LSA dump programe (bootkey/syskey) – pwdump and others
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MALWARE_Win_Meterpreter
Create hunting rule
Author:ditekSHen
Description:Detects Meterpreter payload
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_peb_parsing
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:Windows_Trojan_Metasploit_38b8ceec
Create hunting rule
Description:Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon).
Rule name:Windows_Trojan_Metasploit_7bc0f998
Create hunting rule
Description:Identifies the API address lookup function leverage by metasploit shellcode
Rule name:Windows_Trojan_Metasploit_c9773203
Create hunting rule
Description:Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm
Rule name:win_xiaoba_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.xiaoba.
Rule name:without_attachments
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the no presence of any attachment
Reference:http://laboratorio.blogs.hispasec.com/
Rule name:without_urls
Create hunting rule
Author:Antonio Sanchez <asanchez@hispasec.com>
Description:Rule to detect the no presence of any url
Reference:http://laboratorio.blogs.hispasec.com/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/457333/

Comments