MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 935d4f84f1f1afb65dda0ea548d7e1b77551a1ad2f2a38dcb98a35b23c8a583a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Meterpreter


Vendor detections: 14


Intelligence 14 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 935d4f84f1f1afb65dda0ea548d7e1b77551a1ad2f2a38dcb98a35b23c8a583a
SHA3-384 hash: 7f3be119ef73e129da7b32212299983a17cc04276548dbe500aea85b90531b2aaead42303d4605c751cc2b1d5d9fd276
SHA1 hash: 1404a93c4bd941e395b0c0e628c0f61520b05cc3
MD5 hash: 783ddc6a4471862321e852037f9c6288
humanhash: burger-uncle-sixteen-hydrogen
File name:reverse.exe
Download: download sample
Signature Meterpreter
Create hunting rule
File size:206'848 bytes
First seen:2023-05-27 01:24:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b4c6fff030479aa3b12625be67bf4914 (122 x Meterpreter, 16 x Metasploit, 4 x CobaltStrike)
ssdeep 3072:0b/NPtQdKGlffCIL6T5izPZ/M0Tcgy0mc0drnew60CxXj6nxwsHMr:0UfFLmqZE0TZTb0drnwj6RM
Threatray 32 similar samples on MalwareBazaar
TLSH T1FC146C5632A400B9E973913DC6934B07E7B2B45A03B19BCF07A443BAAF1B7D1653D722
TrID 44.4% (.EXE) Win64 Executable (generic) (10523/12/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter 1ZRR4H
Tags:exe Meterpreter

Intelligence

File Origin
# of uploads :
1
# of downloads :
278
Origin country :
CL CL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
reverse.exe
Verdict:
Malicious activity
Analysis date:
2023-05-27 01:27:44 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/97cc074e-dbd8-4eea-80ca-031d0e8bba9f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Meterpreter
Create hunting rule
Link:
https://www.capesandbox.com/analysis/392339/
Detection(s):
Win.Exploit.D388a-9756522-0
Create hunting rule

Win.Exploit.Meterpreter-9777172-0
Create hunting rule

SecuriteInfo.com.Crypt_r.AKH.14258.12458.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/88106/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
apt cobaltstrike crypto greyware packed
Link:
https://www.filescan.io/uploads/64715befee6159f1413ee03b/reports/1cdaf16d-26c9-4968-83e3-42fa3fb8d8ed/overview
Verdict:
Malicious
Labled as:
Trojan.Metasploit
Link:
https://www.hybrid-analysis.com/sample/935d4f84f1f1afb65dda0ea548d7e1b77551a1ad2f2a38dcb98a35b23c8a583a
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Meterpreter
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/42f70df6-4996-43dc-a130-30bcd433861b
Result
Threat name:
Metasploit, Meterpreter
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1243600
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to inject threads in other processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected Metasploit Payload
Yara detected Meterpreter
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/935d4f84f1f1afb65dda0ea548d7e1b77551a1ad2f2a38dcb98a35b23c8a583a/
Threat name:
Win64.Backdoor.Meterpreter
Create hunting rule
Status:
Malicious
First seen:
2023-05-26 05:05:40 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
22 of 24 (91.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=snou7bhr6gx3mxo2b2surv7bw52vdinnf4vdrxfzri23epekla5a._file
Verdict:
malicious
Similar samples:
4419d9d313d27a7e0b150af9cc38a3b24b47c9594c53daf00692db5ab0c5d968
Meterpreter
7edae5c55be343db06651111ab65397976fea091b66b8bfeb9e50a1a17c8663a
Meterpreter
936537585a8251109ee0e8d7eaa0685c084697acf6ffc866e56fdee102d34dec
Meterpreter
a3c9afd38101d1d6d06ea9e2cffc6b3aeecc46376057c4de56c48645ab62276a
Meterpreter
be3c033ff5bf0df0698deac5b06866d7a0f59767bd51e2afa0da6d4960eafd08
Meterpreter
f835857658248ec00f733146b647004a62ef97d3ad294a3d0aea62a94418a829
Meterpreter
+ 22 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230527-bsyk9sad2y/
Unpacked files
SH256 hash:
935d4f84f1f1afb65dda0ea548d7e1b77551a1ad2f2a38dcb98a35b23c8a583a
MD5 hash:
783ddc6a4471862321e852037f9c6288
SHA1 hash:
1404a93c4bd941e395b0c0e628c0f61520b05cc3
Link:
https://www.unpac.me/results/29a8f531-1c04-49f0-8235-cad35b76d0ca/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.81
Link:
https://yomi.yoroi.company/submissions/935d4f84f1f1afb65dda0ea548d7e1b77551a1ad2f2a38dcb98a35b23c8a583a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT_Lazarus_Loader_Dec_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect loader used by Lazarus group in december 2020
Reference:Internal Research
Rule name:MALWARE_Win_Meterpreter
Create hunting rule
Author:ditekSHen
Description:Detects Meterpreter payload
Rule name:MAL_Malware_Imphash_Mar23_1
Create hunting rule
Author:Arnim Rupp
Description:Detects malware by known bad imphash or rich_pe_header_hash
Reference:https://yaraify.abuse.ch/statistics/
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_peb_parsing
Create hunting rule
Author:Willi Ballenthin
Rule name:Windows_Trojan_Metasploit_38b8ceec
Create hunting rule
Author:Elastic Security
Description:Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon).
Rule name:Windows_Trojan_Metasploit_38b8ceec
Create hunting rule
Description:Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon).
Rule name:Windows_Trojan_Metasploit_7bc0f998
Create hunting rule
Author:Elastic Security
Description:Identifies the API address lookup function leverage by metasploit shellcode
Rule name:Windows_Trojan_Metasploit_7bc0f998
Create hunting rule
Description:Identifies the API address lookup function leverage by metasploit shellcode
Rule name:Windows_Trojan_Metasploit_c9773203
Create hunting rule
Author:Elastic Security
Description:Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm
Rule name:Windows_Trojan_Metasploit_c9773203
Create hunting rule
Description:Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/392339/

Comments