MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1abc133966ea5edf3820bbab01bdbfb6c14555bd7be174e0be18870e3469ee6e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Meterpreter

Vendor detections: 16

Intelligence 16 IOCs YARA 6 File information Comments

SHA256 hash:	1abc133966ea5edf3820bbab01bdbfb6c14555bd7be174e0be18870e3469ee6e
SHA3-384 hash:	68a46beffec5b3b48ed028b7a7974bcdc6423ac538459415b80e58aa5ec5a5d7f19f7c174fbea7211778259c269e0aa7
SHA1 hash:	51821d410fbb24cfb73c34c605a9497574dde166
MD5 hash:	eb0901c83ff26909348c6223b9c39352
humanhash:	maine-rugby-illinois-west
File name:	a.exe
Download:	download sample
Signature	Meterpreter Create hunting rule
File size:	73'802 bytes
First seen:	2026-02-17 11:42:54 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	fb6bd8ebf4e6421b53c55dfe7d3c43af (7 x Meterpreter)
ssdeep	1536:IfjhGeNH0UaAaDFwJA4+s+oQfYq5RxMb+KR0Nc8QsJq39:RsH0ZAaB8ApsyYgRxe0Nc8QsC9
Threatray	1 similar samples on MalwareBazaar
TLSH	T17673BF46C9C01966D1A3123D5B753AB6AA34F5FA3601C19F3A8CCDE5DBD1CB0A3663C2
TrID	39.7% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 21.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 8.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 8.3% (.EXE) Win64 Executable (generic) (6522/11/2) 6.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
Reporter	Joker
Tags:	exe Meterpreter Rozena

Intelligence

File Origin

# of uploads :

# of downloads :

122

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

MetaSploit

Details

MetaSploit

a c2 socket address

Link:

https://research.acce.ciphertechsolutions.com/results/e755e9c3-d1b5-40f4-b97e-ec7595344b0d/

Malware family:

n/a

ID:

File name:

a.exe

Verdict:

Malicious activity

Analysis date:

2026-02-17 11:45:12 UTC

Tags:

metasploit

Link:

https://app.any.run/tasks/376c7673-da49-4a8d-a3b3-04e71e567665

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Rozena

Link:

https://www.capesandbox.com/analysis/53574/

Detection(s):

Win.Trojan.Swrort-5710536-0

BC.Win.Trojan.Swrort-17210

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6994545a2715406c647a83b8

Tags:

shellcode rozena trojan virus

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

base64 cobalt cobalt evasive meterpreter microsoft_visual_cc obfuscated overlay packed rozena swrort

Link:

https://www.filescan.io/uploads/69945458981ff1d38a58a6e5/reports/83fda95a-1c34-4bc9-90e9-a399ff4fafd2/overview

Verdict:

Malicious

Labled as:

Trojan.CryptZ.Marte.1

Link:

https://www.hybrid-analysis.com/sample/1abc133966ea5edf3820bbab01bdbfb6c14555bd7be174e0be18870e3469ee6e

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-02-10T01:32:00Z UTC

Last seen:

2026-02-10T01:56:00Z UTC

Hits:

~10

Detections:

Trojan.Win32.Zenpak.sb Trojan.Win32.Shelm.sb Trojan.Win32.Shelm.c Trojan.Win32.Rekvex.sb HEUR:Trojan.Win32.Shella.gen HEUR:Trojan.Win32.Metla.a HEUR:Trojan.Win32.Generic

Link:

https://opentip.kaspersky.com/1abc133966ea5edf3820bbab01bdbfb6c14555bd7be174e0be18870e3469ee6e/results?tab=lookup

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2c694c34-28fd-45de-bc2e-1869ce89b845

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/1abc133966ea5edf3820bbab01bdbfb6c14555bd7be174e0be18870e3469ee6e

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1abc133966ea5edf3820bbab01bdbfb6c14555bd7be174e0be18870e3469ee6e/

Verdict:

Malicious

Threat:

Family.METASPLOIT

Link:

https://tip.neiki.dev/file/1abc133966ea5edf3820bbab01bdbfb6c14555bd7be174e0be18870e3469ee6e

Threat name:

Win32.Backdoor.Meterpreter

Status:

Malicious

First seen:

2026-02-10 03:37:00 UTC

File Type:

PE (Exe)

AV detection:

34 of 36 (94.44%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dk6bgolg5jpn6obaxovqdpn7w3aukvn5ppqxjyf6dcdq4ndj5zxa._file

Verdict:

malicious

Label(s):

metasploit

Meterpreter

error

Meterpreter

Result

Malware family:

metasploit

Score:

10/10

Tags:

family:metasploit backdoor discovery trojan

Link:

https://tria.ge/reports/260217-nvqpnag14e/

Behaviour

System Location Discovery: System Language Discovery

MetaSploit

Metasploit family

Malware Config

C2 Extraction:

185.167.234.235:9500

Unpacked files

SH256 hash:

1abc133966ea5edf3820bbab01bdbfb6c14555bd7be174e0be18870e3469ee6e

MD5 hash:

eb0901c83ff26909348c6223b9c39352

SHA1 hash:

51821d410fbb24cfb73c34c605a9497574dde166

Link:

https://www.unpac.me/results/33f51b13-72e9-408d-84e8-8e9d25124b61/

Malware family:

Metasploit

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/1abc133966ea/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.62

Link:

https://yomi.yoroi.company/submissions/1abc133966ea5edf3820bbab01bdbfb6c14555bd7be174e0be18870e3469ee6e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	metasploit_rev_tcp_32 Create hunting rule
Author:	Javier Rascon

Rule name:	meth_peb_parsing Create hunting rule
Author:	Willi Ballenthin

Rule name:	Rozena Create hunting rule

Rule name:	SUSP_Imphash_Mar23_2 Create hunting rule
Author:	Arnim Rupp (https://github.com/ruppde)
Description:	Detects imphash often found in malware samples (Zero hits with with search for 'imphash:x p:0' on Virustotal)
Reference:	Internal Research

Rule name:	Windows_Trojan_Metasploit_0cc81460 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Metasploit_4a1c4da8 Create hunting rule
Author:	Elastic Security
Description:	Identifies Metasploit 64 bit reverse tcp shellcode.