MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49da2afba7c87307eea000e281084e14ed6b0d460686bd193cfde8aab44c1893. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Meterpreter

Vendor detections: 15

Intelligence 15 IOCs YARA 7 File information Comments

SHA256 hash:	49da2afba7c87307eea000e281084e14ed6b0d460686bd193cfde8aab44c1893
SHA3-384 hash:	35d8c033758d08a69badd6ec6a53c0ccc74cbb55324545a5f4c9d5c1b82a60ecfd6f207acf569015e73d50435e1f3788
SHA1 hash:	ae733a282a9990ecec11bf3d980d32a2cfee130e
MD5 hash:	ef1a28331563f6e284da86f3159a8c45
humanhash:	happy-magazine-utah-virginia
File name:	SecuriteInfo.com.Trojan.Inject6.5094.4900.32623
Download:	download sample
Signature	Meterpreter Create hunting rule
File size:	7'168 bytes
First seen:	2025-12-10 16:41:05 UTC
Last seen:	2025-12-10 17:37:06 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	c2d02fc98f1d75d7b9457468ec75da0e (12 x Meterpreter, 2 x Metasploit)
ssdeep	24:eFGSG9wSYeUIUMy58XZh9h9ClfAhzaETIAJvP4up+:iG+bexdyeXZh9hMluzaAJH4b
Threatray	3 similar samples on MalwareBazaar
TLSH	T140E100A362365DF7F6392BBD8547978660FC623406D31B0D0A68084651A2A19B8A5F83
TrID	27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 20.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.6% (.EXE) Win32 Executable (generic) (4504/4/1) 8.5% (.ICL) Windows Icons Library (generic) (2059/9) 8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	SecuriteInfoCom
Tags:	exe Meterpreter

Intelligence

File Origin

# of uploads :

# of downloads :

105

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

MetaSploit

Details

MetaSploit

a c2 socket address

Link:

https://research.acce.ciphertechsolutions.com/results/2509674f-4222-4476-8279-c544e901d61d/

Malware family:

n/a

ID:

File name:

SecuriteInfo.com.Trojan.Inject6.5094.4900.32623

Verdict:

No threats detected

Analysis date:

2025-12-10 16:45:41 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/5e5db99b-1a7e-4b84-be10-7210b2337633

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Rozena

Link:

https://www.capesandbox.com/analysis/44176/

Detection(s):

SecuriteInfo.com.Trojan.Inject6.5094.4900.32623.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6939a2babde6a3e5970fe8ed

Tags:

cobaltstrike cobalt

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

cobalt cobalt crypt microsoft_visual_cc packed rozena swrort virus xpack

Link:

https://www.filescan.io/uploads/6939a2b01eac7b9b76a42b6b/reports/c4ac8042-3934-4fbe-894d-94c19ee89782/overview

Verdict:

Malicious

Labled as:

ShellCode.Marte.3.Generic

Link:

https://www.hybrid-analysis.com/sample/49da2afba7c87307eea000e281084e14ed6b0d460686bd193cfde8aab44c1893

Verdict:

Malicious

File Type:

exe x32

First seen:

2025-12-10T12:34:00Z UTC

Last seen:

2025-12-11T00:44:00Z UTC

Hits:

~10

Detections:

Trojan.Win32.CobaltStrike.gen Trojan.Win32.Shelm.c Trojan.Win32.Rekvex.sb HEUR:Trojan.Win32.Shella.gen HEUR:Trojan.Win32.Generic

Link:

https://opentip.kaspersky.com/49da2afba7c87307eea000e281084e14ed6b0d460686bd193cfde8aab44c1893/results?tab=lookup

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/570d77e0-be68-43cb-8d55-ad2283877d72

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/49da2afba7c87307eea000e281084e14ed6b0d460686bd193cfde8aab44c1893

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/ef1a28331563f6e284da86f3159a8c45

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/49da2afba7c87307eea000e281084e14ed6b0d460686bd193cfde8aab44c1893/

Verdict:

Malicious

Threat:

Family.METASPLOIT

Link:

https://tip.neiki.dev/file/49da2afba7c87307eea000e281084e14ed6b0d460686bd193cfde8aab44c1893

Threat name:

Win32.Backdoor.Meterpreter

Status:

Malicious

First seen:

2025-12-09 10:15:41 UTC

File Type:

PE (Exe)

AV detection:

22 of 24 (91.67%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=jhncv65hzbzqp3vaadricccoctwwwdkga2dl2gj47xukvncmdcjq._file

Verdict:

malicious

Label(s):

metasploit

Meterpreter

54446099158a525a638b624d85af6d3530970e9050a8b34d4130d1fbbad2dba3

Meterpreter

Result

Malware family:

metasploit

Score:

10/10

Tags:

family:metasploit backdoor discovery trojan

Link:

https://tria.ge/reports/251210-t69jsszjcr/

Behaviour

System Location Discovery: System Language Discovery

MetaSploit

Metasploit family

Malware Config

C2 Extraction:

157.173.100.101:9002

Verdict:

Malicious

Tags:

red_team_tool metasploit cobalt_strike

YARA:

CobaltStrike_Resources_Reverse_Bin_v2_5_through_v4_x Windows_Trojan_Metasploit_4a1c4da8 Cobalt_functions

Link:

https://app.threat.zone/submission/2bf7d42d-9115-4bab-8f8c-16e12e9d0599

Unpacked files

SH256 hash:

49da2afba7c87307eea000e281084e14ed6b0d460686bd193cfde8aab44c1893

MD5 hash:

ef1a28331563f6e284da86f3159a8c45

SHA1 hash:

ae733a282a9990ecec11bf3d980d32a2cfee130e

Link:

https://www.unpac.me/results/836b5ade-e013-4e94-ba68-3ee3880822c4/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.70

Link:

https://yomi.yoroi.company/submissions/49da2afba7c87307eea000e281084e14ed6b0d460686bd193cfde8aab44c1893

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CobaltStrike_Resources_Reverse_Bin_v2_5_through_v4_x Create hunting rule
Author:	gssincla@google.com
Description:	Cobalt Strike's resources/reverse.bin signature for versions 2.5 to 4.x
Reference:	https://cloud.google.com/blog/products/identity-security/making-cobalt-strike-harder-for-threat-actors-to-abuse

Rule name:	CobaltStrike__Resources_Reverse_Bin_v2_5_through_v4_x Create hunting rule
Author:	gssincla@google.com

Rule name:	metasploit_rev_tcp_32 Create hunting rule
Author:	Javier Rascon

Rule name:	meth_peb_parsing Create hunting rule
Author:	Willi Ballenthin

Rule name:	Rozena Create hunting rule

Rule name:	Windows_Trojan_Metasploit_0cc81460 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Metasploit_4a1c4da8 Create hunting rule
Author:	Elastic Security
Description:	Identifies Metasploit 64 bit reverse tcp shellcode.