MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d8f1b404e0e59a6ca4bf5f19120d8d89dd8a412d7516d900f53a004a6f02fee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Meterpreter

Vendor detections: 17

Intelligence 17 IOCs YARA 17 File information Comments

SHA256 hash:	8d8f1b404e0e59a6ca4bf5f19120d8d89dd8a412d7516d900f53a004a6f02fee
SHA3-384 hash:	8c8853647c998649c3d91292681986ed4dd1ca1323028bd8b4ce3be5770b35ae8e1e97d560af2722fc050c0ebee6b58e
SHA1 hash:	809a7e73afaf614088b1d551e9e96485dc20cda9
MD5 hash:	9cb1012cc56f7998583ebcbd9452cea0
humanhash:	undress-don-mexico-kansas
File name:	sys.exe
Download:	download sample
Signature	Meterpreter Create hunting rule
File size:	208'384 bytes
First seen:	2024-12-25 11:21:22 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b4c6fff030479aa3b12625be67bf4914 (122 x Meterpreter, 16 x Metasploit, 4 x CobaltStrike)
ssdeep	3072:g0E+XfB1GKd/Pq6/Okg15ZLMvTcF1jjS1pE8V4f46ZgLyj6nGycH6My+:gsdaGOBZgvT6XypES4TjFT6
TLSH	T1A0146C5632A400BAE977913CC6938B07E7B6B44A07B097CF076443BAAF1B7D2653D721
TrID	44.4% (.EXE) Win64 Executable (generic) (10522/11/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	Joker
Tags:	exe malware Meterpreter trojan

Intelligence

File Origin

# of uploads :

# of downloads :

371

Origin country :

Vendor Threat Intelligence

Malware family:

meterpreter

ID:

File name:

wow.exe

Verdict:

Malicious activity

Analysis date:

2024-12-17 20:21:49 UTC

Tags:

github loader meterpreter backdoor payload metasploit auto opendir python pyinstaller miner xmrig asyncrat quasarrat

Link:

https://app.any.run/tasks/c27e83ca-b78d-46b4-8a7c-2e193dd21d09

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Exploit.D388a-9756522-0

Win.Exploit.Meterpreter-9777172-0

SecuriteInfo.com.Crypt_r.AKH.14258.12458.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=676beadc75bf3268d2fe6139

Tags:

metasploit emotet rozena

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Connection attempt

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

apt crypto exploit masm metasploit meterpreter packed packed packer_detected rozena xpack

Link:

https://www.filescan.io/uploads/676beadcb227d2dfb4101da4/reports/39ce7257-2840-4f72-afb2-decb715e8e90/overview

Verdict:

Malicious

Labled as:

Trojan.Metasploit

Link:

https://www.hybrid-analysis.com/sample/8d8f1b404e0e59a6ca4bf5f19120d8d89dd8a412d7516d900f53a004a6f02fee

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Metasploit Framework

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9cd66e8f-747e-4d68-b2e3-eb6b0b0acd05

Result

Threat name:

Metasploit, Meterpreter

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1580603

Signature

AI detected suspicious sample

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject threads in other processes

Found direct / indirect Syscall (likely to bypass EDR)

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Metasploit Payload

Yara detected Meterpreter

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/8d8f1b404e0e59a6ca4bf5f19120d8d89dd8a412d7516d900f53a004a6f02fee

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8d8f1b404e0e59a6ca4bf5f19120d8d89dd8a412d7516d900f53a004a6f02fee/

Threat name:

Win64.Backdoor.Meterpreter

Status:

Malicious

First seen:

2024-12-13 12:28:44 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

35 of 38 (92.11%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=rwhrwqcobzm2nssl6xyzcigy3co5rjas25iw3eapkoqajjxqf7xa._file

Verdict:

malicious

Label(s):

metasploit

Similar samples:

error

Meterpreter

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/241225-ngjzysslgw/

Verdict:

Malicious

Tags:

red_team_tool cobalt_strike metasploit trojan meterpreter Win.Exploit.D388a-9756522-0

YARA:

Stairwell_CobaltStrike_Stager_API_Hashing Windows_Trojan_Metasploit_38b8ceec Windows_Trojan_Metasploit_7bc0f998 Windows_Trojan_Metasploit_c9773203 MALWARE_Win_Meterpreter MAL_Malware_Imphash_Mar23_1

Link:

https://app.threat.zone/submission/0212ccde-cd72-4c63-a42e-3ba3160b6c09

Unpacked files

SH256 hash:

b7ca94c487621f21f76a45ba632e66977020dd35e23718f35c058437940d6cd8

MD5 hash:

184924843e5f0a4694f77d3ba335dc9d

SHA1 hash:

ce56a7d494fd170a5e4ecd262d882bdd2aaf2162

Detections:

MALWARE_Win_Meterpreter

Link:

https://www.unpac.me/results/d83add4e-e34c-48af-9ea9-6539450db593/

Parent samples :

01c4c4582cdfc256135e87ae42ebccb02f2c2cdea4a37c233948a3ac454e1593
592474a6afcaa6a1147524a4a24ae9a535cd58f043e218ab64ae218ee7229f42
e477416cf4c7f6a79b5b0b88d28aff708c6b89f4fb93b775ad2b6f69020680a3
d46988f81eb72e8587a297dfb345ea39eba96a9ba248041424fd8e2191a49cf7
053542ef7ed95b8bb4cc040e732cf4fad01e24c3a60b3b1c3b1c794b6bcf8d55
8d8f1b404e0e59a6ca4bf5f19120d8d89dd8a412d7516d900f53a004a6f02fee

SH256 hash:

8d8f1b404e0e59a6ca4bf5f19120d8d89dd8a412d7516d900f53a004a6f02fee

MD5 hash:

9cb1012cc56f7998583ebcbd9452cea0

SHA1 hash:

809a7e73afaf614088b1d551e9e96485dc20cda9

Link:

https://www.unpac.me/results/d83add4e-e34c-48af-9ea9-6539450db593/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.87

Link:

https://yomi.yoroi.company/submissions/8d8f1b404e0e59a6ca4bf5f19120d8d89dd8a412d7516d900f53a004a6f02fee

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	APT_Lazarus_Loader_Dec_2020_1 Create hunting rule
Author:	Arkbird_SOLG
Description:	Detect loader used by Lazarus group in december 2020
Reference:	Internal Research

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MALWARE_Win_Meterpreter Create hunting rule
Author:	ditekSHen
Description:	Detects Meterpreter payload

Rule name:	MAL_Malware_Imphash_Mar23_1 Create hunting rule
Author:	Arnim Rupp
Description:	Detects malware by known bad imphash or rich_pe_header_hash
Reference:	https://yaraify.abuse.ch/statistics/

Rule name:	meth_peb_parsing Create hunting rule
Author:	Willi Ballenthin

Rule name:	RansomPyShield_Antiransomware Create hunting rule
Author:	XiAnzheng
Description:	Check for Suspicious String and Import combination that Ransomware mostly abuse(can create FP)

Rule name:	Windows_Trojan_Metasploit_38b8ceec Create hunting rule
Description:	Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon).

Rule name:	Windows_Trojan_Metasploit_38b8ceec Create hunting rule
Author:	Elastic Security
Description:	Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon).

Rule name:	Windows_Trojan_Metasploit_7bc0f998 Create hunting rule
Description:	Identifies the API address lookup function leverage by metasploit shellcode

Rule name:	Windows_Trojan_Metasploit_7bc0f998 Create hunting rule
Author:	Elastic Security
Description:	Identifies the API address lookup function leverage by metasploit shellcode

Rule name:	Windows_Trojan_Metasploit_c9773203 Create hunting rule
Description:	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:	https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm

Rule name:	Windows_Trojan_Metasploit_c9773203 Create hunting rule
Author:	Elastic Security
Description:	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:	https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Meterpreter

exe 8d8f1b404e0e59a6ca4bf5f19120d8d89dd8a412d7516d900f53a004a6f02fee

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3353214/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample