MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 676ec23b1b5d06e240079a9dfd7f67628d4adb0257857fef3008c489883ac517. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Metasploit


Vendor detections: 14


Intelligence 14 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 676ec23b1b5d06e240079a9dfd7f67628d4adb0257857fef3008c489883ac517
SHA3-384 hash: 5e226559f5687f303f723bcdb9bbc68e1a7f78b9a9ba3c34f9f94fe196611ee869ff477af299fc221efca604fc6fdfd6
SHA1 hash: 92a0dc958120f21d151fbbf7c3bcbb613f473cc4
MD5 hash: bb02c5b668e01883c381ff5948045473
humanhash: gee-sink-helium-beryllium
File name:msf_aes_loader.exe
Download: download sample
Signature Metasploit
Create hunting rule
File size:20'480 bytes
First seen:2025-05-06 10:35:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 8c29e55bb08160a26464dd5ce0eefc83 (1 x Metasploit)
ssdeep 192:gC2clteu+JpvoXqrO5tcWIVDsyoChw03bk4tiu9rdIVzmkZV3uy0vuY/pB8I/li2:gCZlteYaC5tchDsyoCoVS6ISwlifCW
Threatray 42 similar samples on MalwareBazaar
TLSH T11492C6BFEF23C4D9C086A2F832CA8AB565F5FD224DA5520D139252207F475844FB9786
TrID 41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
26.1% (.EXE) Win64 Executable (generic) (10522/11/4)
12.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
5.1% (.ICL) Windows Icons Library (generic) (2059/9)
5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter kafan_shengui
Tags:exe Metasploit


Avatar
kafan_shengui
C&C:121.41.178[dot]53

Intelligence

File Origin
# of uploads :
1
# of downloads :
566
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
msf_aes_loader.exe
Verdict:
Malicious activity
Analysis date:
2025-05-06 10:34:36 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/1cb9d8de-2a0a-4dc6-a933-5bc27e3d9c27

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Dump.Generic.ShellCode.Marte.4.0B99739E.20156.29098.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6819e71b432e243ac3e4922f
Tags:
shellcode trojan virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Searching for the window
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug packed
Link:
https://www.filescan.io/uploads/6819e61ed95f3e34e961bfc9/reports/0de03f49-a079-48d2-9eee-dad1ce8637d7/overview
Verdict:
Malicious
Labled as:
Dump:Generic.ShellCode.Marte.4
Link:
https://www.hybrid-analysis.com/sample/676ec23b1b5d06e240079a9dfd7f67628d4adb0257857fef3008c489883ac517
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/db396f90-ed85-4001-b068-4932ad35506b
Result
Threat name:
Metasploit
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1682055
Signature
C2 URLs / IPs found in malware configuration
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Potentially Suspicious Malware Callback Communication
Yara detected Metasploit Payload
Behaviour
Behavior Graph:
Download SVG
Score:
98%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/676ec23b1b5d06e240079a9dfd7f67628d4adb0257857fef3008c489883ac517
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/676ec23b1b5d06e240079a9dfd7f67628d4adb0257857fef3008c489883ac517/
Threat name:
Win64.Backdoor.Meterpreter
Create hunting rule
Status:
Malicious
First seen:
2025-05-06 10:36:15 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=m5xmeoy3ludoeqahtko7273hmkguvwyck6cx73zqbdcitcb2yulq._file
Verdict:
malicious
Label(s):
metasploit
Create hunting rule
Similar samples:
0cc6d724ac017163b40866c820fd67df6ac89924a623490ec1de2ecacf1d0219
Metasploit
2a4f52e877fbc6c6773407d46a5f820523a4254e88d1889bd52b628b5a8b2494
Metasploit
59e9cefe4411c1b5dcd224d0dda03bce7fe92ced01860bb385174c5aae117f3e
Metasploit
676ec23b1b5d06e240079a9dfd7f67628d4adb0257857fef3008c489883ac517
Metasploit
8a9ad8b99cbfeda472193ab63a8f5857fb2659ef08343187569ceb0e4b8dbc13
Metasploit
9ddf7d7b6b8a159202e385f9b60ab88efd888f8f2db3daba205b0b33301572fa
Metasploit
error
Metasploit
+ 32 additional samples on MalwareBazaar
Result
Malware family:
metasploit
Create hunting rule
Score:
  10/10
Tags:
family:metasploit backdoor trojan
Link:
https://tria.ge/reports/250506-mncc1scp4w/
Behaviour
MetaSploit
Metasploit family
Malware Config
C2 Extraction:
121.41.178.53:4455
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/aa4a01a4-361a-4d9b-abad-4723414d4af3
Unpacked files
SH256 hash:
676ec23b1b5d06e240079a9dfd7f67628d4adb0257857fef3008c489883ac517
MD5 hash:
bb02c5b668e01883c381ff5948045473
SHA1 hash:
92a0dc958120f21d151fbbf7c3bcbb613f473cc4
Link:
https://www.unpac.me/results/b0fddfde-4a26-483d-8ded-25956319e666/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.89
Link:
https://yomi.yoroi.company/submissions/676ec23b1b5d06e240079a9dfd7f67628d4adb0257857fef3008c489883ac517

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (GUARD_CF)high
CHECK_TRUST_INFORequires Elevated Execution (uiAccess:None)high
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CreateThread

Comments