MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 460767dc86f6f375250aed8727b46d7e42393bdd9cd31bb91350740832f5ff80. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Meterpreter


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 460767dc86f6f375250aed8727b46d7e42393bdd9cd31bb91350740832f5ff80
SHA3-384 hash: f24a2fc0137c6652624329b9e5f8e4018b036dc8fece0e1c2d35dc0a4328ebafc4de8d1c69a80b972b893c1f6d2eeef9
SHA1 hash: 0cd4d2c3025f8eecf315fd5f0d3e6b11e7f4e5e1
MD5 hash: 2cb908660103e6449ac76bdae06d81c2
humanhash: aspen-sierra-kentucky-may
File name:ndulele.exe
Download: download sample
Signature Meterpreter
Create hunting rule
File size:73'802 bytes
First seen:2022-10-28 22:00:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 481f47bbb2c9c21e108d65f52b04c448 (257 x Meterpreter, 93 x Metasploit, 33 x ShikataGaNai)
ssdeep 1536:IRzHYsNS6WbtF2BeGoSDGBnjokWzY11Mb+KR0Nc8QsJq39:EzHZWsMGRk1YW1e0Nc8QsC9
Threatray 34 similar samples on MalwareBazaar
TLSH T1D373B042D9C05476D2A6113D67713B75A970F6FB7301C28B3A8CDDE5DBC18B0A2663CA
TrID 38.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
13.0% (.EXE) Win64 Executable (generic) (10523/12/4)
8.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter r3dbU7z
Tags:exe Metasploit Meterpreter

Intelligence

File Origin
# of uploads :
1
# of downloads :
349
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ndulele.exe
Verdict:
No threats detected
Analysis date:
2022-10-28 22:02:40 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/80d92944-fdc9-4329-b13f-7fdd65bc4c0a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/325660/
Detection(s):
Win.Trojan.Swrort-5710536-0
Create hunting rule

BC.Win.Trojan.Swrort-17210
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
cobalt greyware overlay packed
Link:
https://www.filescan.io/uploads/635c511e9b2225917c1c2df7/reports/fe4aacf6-80c9-4f62-88e5-16f02abfdc6f/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6a5030be-a3c7-46f9-ba0d-62141ffacd03
Result
Threat name:
Metasploit
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1100657
Signature
Antivirus / Scanner detection for submitted sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Yara detected Metasploit Payload
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/460767dc86f6f375250aed8727b46d7e42393bdd9cd31bb91350740832f5ff80/
Threat name:
Win32.Trojan.Swrort
Create hunting rule
Status:
Malicious
First seen:
2022-10-28 22:04:15 UTC
File Type:
PE (Exe)
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=iydwpxeg63zxkjik5wdspndnpzbdso65ttjrxoitkb2aqmxv76aa._file
Verdict:
malicious
Similar samples:
078ed1c95f7b0da4e83a6d6c60cb7e4635335f7e1ea8dd8c9a840a578311ece7
Meterpreter
47d4baa592dc8afc592d3a342da85af103f96adf0dba589e1a478363af664768
Meterpreter
8f7053239f0e87e477844b19c2928fb867a666ace72eaf9cd243f10e45f30fd4
Meterpreter
c2c30bec9284a586fa17804b628bbd7e0eba352911b56f247c3e2bc89a118413
Meterpreter
e4b0c115d4e9d19bb7bfe61e3a75d5e50d8f5b96d297431da06cfdcf24d3cab3
Meterpreter
+ 24 additional samples on MalwareBazaar
Result
Malware family:
metasploit
Create hunting rule
Score:
  10/10
Tags:
family:metasploit
Link:
https://tria.ge/reports/221028-1w7e1shedk/
Malware Config
C2 Extraction:
192.168.244.153:4444
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/51ba2710-a98f-45a7-b82f-5b73b0c5d56d
Unpacked files
SH256 hash:
460767dc86f6f375250aed8727b46d7e42393bdd9cd31bb91350740832f5ff80
MD5 hash:
2cb908660103e6449ac76bdae06d81c2
SHA1 hash:
0cd4d2c3025f8eecf315fd5f0d3e6b11e7f4e5e1
Link:
https://www.unpac.me/results/9cc88747-7442-4579-959c-7bef2ab46d15/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/460767dc86f6f375250aed8727b46d7e42393bdd9cd31bb91350740832f5ff80

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:metasploit_rev_tcp_32
Create hunting rule
Author:Javier Rascon
Rule name:meth_peb_parsing
Create hunting rule
Author:Willi Ballenthin
Rule name:Windows_Trojan_Metasploit_4a1c4da8
Create hunting rule
Author:Elastic Security
Description:Identifies Metasploit 64 bit reverse tcp shellcode.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Meterpreter

Executable exe 460767dc86f6f375250aed8727b46d7e42393bdd9cd31bb91350740832f5ff80

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/325660/

Comments