MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 452f2dc26a3f958d9c854ff256e56c78cf004d6d53660b6b6294cb2e2e522033. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Meterpreter

Vendor detections: 17

Intelligence 17 IOCs YARA 22 File information Comments

SHA256 hash:	452f2dc26a3f958d9c854ff256e56c78cf004d6d53660b6b6294cb2e2e522033
SHA3-384 hash:	712adc80c21022ac2048cf2dfeb413bb4eb11611709be94997271e111a83541039941061cd1aa86b52b92785be7f2fbc
SHA1 hash:	2f759f64c926880a599ee1d1f4d9ffbffb5d290c
MD5 hash:	cc0d8fbb645cff9a038cd9899bb8447b
humanhash:	six-alaska-robert-london
File name:	meter64.exe
Download:	download sample
Signature	Meterpreter Create hunting rule
File size:	251'904 bytes
First seen:	2026-09-25 19:20:43 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	c2d02fc98f1d75d7b9457468ec75da0e (28 x Meterpreter, 3 x Metasploit)
ssdeep	6144:Y0KiW6orphb7vHZ6niPvAO/qmq7jplEvA:Y0ePphnPZcBu3Ejpiv
TLSH	T184347D4A76A41C6AEDB7823EC9534A0AD7F2B8020751C7CF07A443AB6F177D1663E721
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	BlinkzSec
Tags:	Meterpreter

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/e3013eef-09ff-4481-8391-7a9eb91eca7f/

Malware family:

mimikatz

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-09-25 19:30:34 UTC

Tags:

backdoor metasploit shellcode mimikatz tool

Link:

https://app.any.run/tasks/c4e28a64-baf6-4c15-81f0-75e5094c414d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Meterpreter

Link:

https://www.capesandbox.com/analysis/89029/

Detection(s):

Win.Exploit.D388a-9756522-0

Win.Exploit.Meterpreter-9777172-0

YARA.DITEKSHEN_MALWARE_Win_Meterpreter.UNOFFICIAL

SecuriteInfo.com.Variant.Application.tedy.2261.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Connection attempt

Sending a custom TCP request

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

crypto exploit microsoft_visual_cc packed

Link:

https://www.filescan.io/uploads/6ab6cbd2b231515463a018e3/reports/fd02afe4-84b5-4040-94b7-0c07c2deb175/overview

Verdict:

Malicious

Labled as:

Dump:Generic.Beacon.Marte.B

Link:

https://www.hybrid-analysis.com/sample/452f2dc26a3f958d9c854ff256e56c78cf004d6d53660b6b6294cb2e2e522033

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-09-25T17:52:00Z UTC

Last seen:

2026-09-26T22:07:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/452f2dc26a3f958d9c854ff256e56c78cf004d6d53660b6b6294cb2e2e522033/results?tab=lookup

Malware family:

Metasploit Framework

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/39a62cb9-c5e6-4fa6-a927-125a35baa46e

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/452f2dc26a3f958d9c854ff256e56c78cf004d6d53660b6b6294cb2e2e522033

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/cc0d8fbb645cff9a038cd9899bb8447b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/452f2dc26a3f958d9c854ff256e56c78cf004d6d53660b6b6294cb2e2e522033/

Threat name:

Win64.Infostealer.Tinba

Status:

Malicious

First seen:

2026-09-25 19:18:10 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=iuxs3qtkh6ky3hefj7zfnzlmpdhqatlnkntaw23cstfs4lsseazq._file

Verdict:

malicious

Label(s):

Metasploit

Link:

https://reports.threatray.com/93f6d9f5-bcbb-4abc-ba46-673d6f28c966

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/260925-x2r1qsvdjc/

Behaviour

Reads the TCP/IP host and domain name from the registry

Unpacked files

SH256 hash:

452f2dc26a3f958d9c854ff256e56c78cf004d6d53660b6b6294cb2e2e522033

MD5 hash:

cc0d8fbb645cff9a038cd9899bb8447b

SHA1 hash:

2f759f64c926880a599ee1d1f4d9ffbffb5d290c

Detections:

triage_cobaltstrike_sc_rot13

triage_meterpreter

Link:

https://www.unpac.me/results/8d9d1320-2405-4098-b44d-5c179e1b528b/

SH256 hash:

ee12e52be2ee08df2af0f9c4bc7d66bfa8a0df87af5366723ac1dc63000c1e39

MD5 hash:

d82f0f7c02492c267d9a3c2cfe16d9b3

SHA1 hash:

34f557fcc33512535202b0391ff6a81256d8df10

Detections:

triage_cobaltstrike_sc_rot13

triage_meterpreter

MALWARE_Win_Meterpreter

Link:

https://www.unpac.me/results/8d9d1320-2405-4098-b44d-5c179e1b528b/

Parent samples :

452f2dc26a3f958d9c854ff256e56c78cf004d6d53660b6b6294cb2e2e522033
33a4efae8ea37b66a9e13b5d87aff9e18a96141522f4681b29a56c369625dfe9
fb81ff9e9a7de7bd80fe0ab14f44bb84c888804b5eeaab6212c039037d342d8d

Malware family:

Metasploit

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/452f2dc26a3f/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.87

Link:

https://yomi.yoroi.company/submissions/452f2dc26a3f958d9c854ff256e56c78cf004d6d53660b6b6294cb2e2e522033

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	lsadump Create hunting rule
Author:	Benjamin DELPY (gentilkiwi)
Description:	LSA dump programe (bootkey/syskey) – pwdump and others

Rule name:	MALWARE_Win_Meterpreter Create hunting rule
Author:	ditekSHen
Description:	Detects Meterpreter payload

Rule name:	meth_peb_parsing Create hunting rule
Author:	Willi Ballenthin

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	Windows_Trojan_Metasploit_0cc81460 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Metasploit_38b8ceec Create hunting rule
Description:	Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon).

Rule name:	Windows_Trojan_Metasploit_38b8ceec Create hunting rule
Author:	Elastic Security
Description:	Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon).

Rule name:	Windows_Trojan_Metasploit_7bc0f998 Create hunting rule
Description:	Identifies the API address lookup function leverage by metasploit shellcode

Rule name:	Windows_Trojan_Metasploit_7bc0f998 Create hunting rule
Author:	Elastic Security
Description:	Identifies the API address lookup function leverage by metasploit shellcode

Rule name:	Windows_Trojan_Metasploit_c9773203 Create hunting rule
Description:	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:	https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm

Rule name:	Windows_Trojan_Metasploit_c9773203 Create hunting rule
Author:	Elastic Security
Description:	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:	https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm