MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b1b772478431d588e30424cd1ee0bb53d2c902dbd27b3ce56a8c7a886637ddf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Meterpreter


Vendor detections: 16


Intelligence 16 IOCs 1 YARA 23 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6b1b772478431d588e30424cd1ee0bb53d2c902dbd27b3ce56a8c7a886637ddf
SHA3-384 hash: 1e3325f46d67cb96e12a35c6b73803081de25124033a2d807791e4fc1dd1845389f2ebf7d420646008241a44d7e0db1e
SHA1 hash: 770ffd65328f6212185ce28f13e0888c341e80f7
MD5 hash: 91770b901492ddc202a214975266d7b3
humanhash: high-delaware-football-summer
File name:6b1b772478431d588e30424cd1ee0bb53d2c902dbd27b.exe
Download: download sample
Signature Meterpreter
Create hunting rule
File size:296'448 bytes
First seen:2025-08-18 15:45:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b4c6fff030479aa3b12625be67bf4914 (124 x Meterpreter, 16 x Metasploit, 4 x CobaltStrike)
ssdeep 3072:BfU/XTnWi/2E5mL30fbZw6FX8I/L2Ap01Y36TMDpCGTx36OLwcxxwxj5aSI1IlSX:gbY3jIKN1FToJ133uxj0SdlE
TLSH T1EB54D787F2BA14E5D8B6C1395693722BBAB2B8564774DB8BC300564B1F23BF0A53D344
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter abuse_ch
Tags:exe Meterpreter


Avatar
abuse_ch
Meterpreter C2:
5.83.218.183:4670

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
5.83.218.183:4670 https://threatfox.abuse.ch/ioc/1570734/

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
meterpreter
Create hunting rule
ID:
1
File name:
6b1b772478431d588e30424cd1ee0bb53d2c902dbd27b.exe
Verdict:
Malicious activity
Analysis date:
2025-08-18 15:48:31 UTC
Tags:
meterpreter backdoor payload metasploit shellcode mimikatz tools
Link:
https://app.any.run/tasks/1ad605c1-779c-473f-9b6b-cf62c6b04067

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Meterpreter
Create hunting rule
Link:
https://www.capesandbox.com/analysis/21973/
Detection(s):
Win.Exploit.D388a-9756522-0
Create hunting rule

Win.Exploit.Meterpreter-9777172-0
Create hunting rule

SecuriteInfo.com.Crypt_r.AKH.14258.12458.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68a34ac6c2f5296a1a28332a
Tags:
emotet rozena
Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Connection attempt
Sending a custom TCP request
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug crypt crypto exploit masm metasploit meterpreter packed rozena xpack
Link:
https://www.filescan.io/uploads/68a34ab9a4bdac9f5b9c446b/reports/3659fae4-3f9f-4067-92df-32da914ec3f3/overview
Verdict:
Malicious
Labled as:
Trojan.Metasploit
Link:
https://www.hybrid-analysis.com/sample/6b1b772478431d588e30424cd1ee0bb53d2c902dbd27b3ce56a8c7a886637ddf
Gathering data
Result
Threat name:
Metasploit, Meterpreter
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1759452
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Contains functionality to change the desktop window for a process (likely to hide graphical interactions)
Contains functionality to check if the process is started with administrator privileges
Contains functionality to inject code into remote processes
Contains functionality to inject threads in other processes
Creates a thread in another existing process (thread injection)
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Suspect Svchost Activity
Suricata IDS alerts for network traffic
Writes to foreign memory regions
Yara detected Metasploit Payload
Yara detected Meterpreter
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/6b1b772478431d588e30424cd1ee0bb53d2c902dbd27b3ce56a8c7a886637ddf
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/91770b901492ddc202a214975266d7b3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6b1b772478431d588e30424cd1ee0bb53d2c902dbd27b3ce56a8c7a886637ddf/
Threat name:
Win64.Backdoor.Meterpreter
Create hunting rule
Status:
Malicious
First seen:
2025-08-15 19:10:00 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
31 of 36 (86.11%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nmnxojdyimovrdrqijgnd3qlwu6szebnxut3htswvdd2rbtdpxpq._file
Verdict:
malicious
Label(s):
metasploit
Create hunting rule
Similar samples:
error
Meterpreter
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/250818-s7k26aak4t/
Behaviour
Suspicious use of WriteProcessMemory
Verdict:
Malicious
Tags:
red_team_tool metasploit trojan meterpreter Win.Exploit.D388a-9756522-0 Metasploit
YARA:
Windows_Trojan_Metasploit_38b8ceec Windows_Trojan_Metasploit_7bc0f998 Windows_Trojan_Metasploit_c9773203 MALWARE_Win_Meterpreter MAL_Malware_Imphash_Mar23_1
Link:
https://app.threat.zone/submission/3c1755fd-d85e-488f-9c8d-31ccc6e80741
Unpacked files
SH256 hash:
6b1b772478431d588e30424cd1ee0bb53d2c902dbd27b3ce56a8c7a886637ddf
MD5 hash:
91770b901492ddc202a214975266d7b3
SHA1 hash:
770ffd65328f6212185ce28f13e0888c341e80f7
Link:
https://www.unpac.me/results/95220418-0bb5-48e8-b114-fc3cfd7bd8b7/
SH256 hash:
ae54711a950fe1d4271e371d4f0fa817d488336da5834d96620e1d2e4ea9950f
MD5 hash:
1b3abcbaded93b273b0ab536c9b9b4c2
SHA1 hash:
015b6a14fd4d58eca94f0704e273351ececdf5d2
Detections:
MALWARE_Win_Meterpreter
Create hunting rule
Link:
https://www.unpac.me/results/95220418-0bb5-48e8-b114-fc3cfd7bd8b7/
Parent samples :
6b1b772478431d588e30424cd1ee0bb53d2c902dbd27b3ce56a8c7a886637ddf
9dacc222fdbcf8535cc003638cb89f1042ac199cc1fc1e1e4867426a90229c05
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.92
Link:
https://yomi.yoroi.company/submissions/6b1b772478431d588e30424cd1ee0bb53d2c902dbd27b3ce56a8c7a886637ddf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT_Lazarus_Loader_Dec_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect loader used by Lazarus group in december 2020
Reference:Internal Research
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:lsadump
Create hunting rule
Author:Benjamin DELPY (gentilkiwi)
Description:LSA dump programe (bootkey/syskey) – pwdump and others
Rule name:MALWARE_Win_Meterpreter
Create hunting rule
Author:ditekSHen
Description:Detects Meterpreter payload
Rule name:MAL_Malware_Imphash_Mar23_1
Create hunting rule
Author:Arnim Rupp
Description:Detects malware by known bad imphash or rich_pe_header_hash
Reference:https://yaraify.abuse.ch/statistics/
Rule name:meth_peb_parsing
Create hunting rule
Author:Willi Ballenthin
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Windows_Trojan_Metasploit_1ca1e384
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Metasploit_38b8ceec
Create hunting rule
Description:Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon).
Rule name:Windows_Trojan_Metasploit_38b8ceec
Create hunting rule
Author:Elastic Security
Description:Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon).
Rule name:Windows_Trojan_Metasploit_47f5d54a
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Metasploit_7bc0f998
Create hunting rule
Description:Identifies the API address lookup function leverage by metasploit shellcode
Rule name:Windows_Trojan_Metasploit_7bc0f998
Create hunting rule
Author:Elastic Security
Description:Identifies the API address lookup function leverage by metasploit shellcode
Rule name:Windows_Trojan_Metasploit_c9773203
Create hunting rule
Description:Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm
Rule name:Windows_Trojan_Metasploit_c9773203
Create hunting rule
Author:Elastic Security
Description:Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/21973/

Comments