MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9dacc222fdbcf8535cc003638cb89f1042ac199cc1fc1e1e4867426a90229c05. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Meterpreter

Vendor detections: 15

Intelligence 15 IOCs 1 YARA 23 File information Comments

SHA256 hash:	9dacc222fdbcf8535cc003638cb89f1042ac199cc1fc1e1e4867426a90229c05
SHA3-384 hash:	fa46a7e7c9a4f4142f596ec8aef8a9d6385f7c6fbbd45d9f63c18bd3784737a431673e98be445e0a87aa410ef8c6800b
SHA1 hash:	ac4128dd886099ccfc532d47bd652aa8ad41c828
MD5 hash:	b84b02f3aebfe1c728155a9796722cd2
humanhash:	eight-five-green-connecticut
File name:	svhost.exe
Download:	download sample
Signature	Meterpreter Create hunting rule
File size:	296'448 bytes
First seen:	2025-08-19 05:25:15 UTC
Last seen:	2025-08-19 21:05:08 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	b4c6fff030479aa3b12625be67bf4914 (124 x Meterpreter, 16 x Metasploit, 4 x CobaltStrike)
ssdeep	3072:/fU/XTnWi/2E5mL30fbZw6FX8I/L2Ap01Y36TMDpCGTx36OLwcxxwxj5aSI1IlSo:ubY3jIKN1FToJ133uxj0SdlE
TLSH	T19F54D787F2BA14E5D8B6C1395693722BBAB2B4564774DB8BC300564B1F23BF0A53E344
TrID	44.4% (.EXE) Win64 Executable (generic) (10522/11/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	abuse_ch
Tags:	exe Meterpreter

abuse_ch

Meterpreter C2:
5.83.218.183:4467

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
5.83.218.183:4467	https://threatfox.abuse.ch/ioc/1571151/

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

_9dacc222fdbcf8535cc003638cb89f1042ac199cc1fc1e1e4867426a90229c05.exe

Verdict:

No threats detected

Analysis date:

2025-08-19 05:35:24 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/b970b71b-2874-4570-ab82-49b3965f120a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Meterpreter

Link:

https://www.capesandbox.com/analysis/22057/

Detection(s):

Win.Exploit.D388a-9756522-0

Win.Exploit.Meterpreter-9777172-0

SecuriteInfo.com.Crypt_r.AKH.14258.12458.UNOFFICIAL

Verdict:

Malicious

Score:

94.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68a40b28c2f5296a1a2840d2

Tags:

shellcode emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Connection attempt

Sending a custom TCP request

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

exploit masm obfuscated packed packed packer_detected

Link:

https://www.filescan.io/uploads/68a40b6b419c816a6e8b7223/reports/1cf4f760-3d2a-4467-b723-241cd933601d/overview

Verdict:

Malicious

Labled as:

Trojan.Metasploit

Link:

https://www.hybrid-analysis.com/sample/9dacc222fdbcf8535cc003638cb89f1042ac199cc1fc1e1e4867426a90229c05

Gathering data

Result

Threat name:

Metasploit, Meterpreter

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1759849

Signature

Allocates memory in foreign processes

Antivirus / Scanner detection for submitted sample

C2 URLs / IPs found in malware configuration

Contains functionality to change the desktop window for a process (likely to hide graphical interactions)

Contains functionality to check if the process is started with administrator privileges

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Creates a thread in another existing process (thread injection)

Found malware configuration

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Suspect Svchost Activity

Suricata IDS alerts for network traffic

Writes to foreign memory regions

Yara detected Metasploit Payload

Yara detected Meterpreter

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/9dacc222fdbcf8535cc003638cb89f1042ac199cc1fc1e1e4867426a90229c05

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/b84b02f3aebfe1c728155a9796722cd2

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9dacc222fdbcf8535cc003638cb89f1042ac199cc1fc1e1e4867426a90229c05/

Verdict:

Malicious

Threat:

Trojan.Win64.Meterpreter

Link:

https://tip.neiki.dev/file/9dacc222fdbcf8535cc003638cb89f1042ac199cc1fc1e1e4867426a90229c05

Threat name:

Win64.Backdoor.Meterpreter

Status:

Malicious

First seen:

2025-08-19 05:29:34 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

32 of 37 (86.49%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=twwmeix5xt4fgxgaanryzoe7cbbkygm4yh6b4hsim5bgvebctqcq._file

Verdict:

malicious

Label(s):

metasploit

Similar samples:

error

Meterpreter

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/250819-f56jvsgn7x/

Behaviour

Suspicious use of WriteProcessMemory

Verdict:

Malicious

Tags:

red_team_tool metasploit trojan meterpreter Win.Exploit.D388a-9756522-0 Metasploit

YARA:

Windows_Trojan_Metasploit_38b8ceec Windows_Trojan_Metasploit_7bc0f998 Windows_Trojan_Metasploit_c9773203 MALWARE_Win_Meterpreter MAL_Malware_Imphash_Mar23_1

Link:

https://app.threat.zone/submission/95d3ea02-9f82-420f-88bd-fd4df2195bcf

Unpacked files

SH256 hash:

9dacc222fdbcf8535cc003638cb89f1042ac199cc1fc1e1e4867426a90229c05

MD5 hash:

b84b02f3aebfe1c728155a9796722cd2

SHA1 hash:

ac4128dd886099ccfc532d47bd652aa8ad41c828

Link:

https://www.unpac.me/results/be8606ba-58d8-4f4d-abbb-ccdfa78454b8/

SH256 hash:

ae54711a950fe1d4271e371d4f0fa817d488336da5834d96620e1d2e4ea9950f

MD5 hash:

1b3abcbaded93b273b0ab536c9b9b4c2

SHA1 hash:

015b6a14fd4d58eca94f0704e273351ececdf5d2

Detections:

MALWARE_Win_Meterpreter

Link:

https://www.unpac.me/results/be8606ba-58d8-4f4d-abbb-ccdfa78454b8/

Parent samples :

6b1b772478431d588e30424cd1ee0bb53d2c902dbd27b3ce56a8c7a886637ddf
9dacc222fdbcf8535cc003638cb89f1042ac199cc1fc1e1e4867426a90229c05

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/9dacc222fdbc/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.92

Link:

https://yomi.yoroi.company/submissions/9dacc222fdbcf8535cc003638cb89f1042ac199cc1fc1e1e4867426a90229c05

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	APT_Lazarus_Loader_Dec_2020_1 Create hunting rule
Author:	Arkbird_SOLG
Description:	Detect loader used by Lazarus group in december 2020
Reference:	Internal Research

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	lsadump Create hunting rule
Author:	Benjamin DELPY (gentilkiwi)
Description:	LSA dump programe (bootkey/syskey) – pwdump and others

Rule name:	MALWARE_Win_Meterpreter Create hunting rule
Author:	ditekSHen
Description:	Detects Meterpreter payload

Rule name:	MAL_Malware_Imphash_Mar23_1 Create hunting rule
Author:	Arnim Rupp
Description:	Detects malware by known bad imphash or rich_pe_header_hash
Reference:	https://yaraify.abuse.ch/statistics/

Rule name:	meth_peb_parsing Create hunting rule
Author:	Willi Ballenthin

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Windows_Trojan_Metasploit_1ca1e384 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Metasploit_38b8ceec Create hunting rule
Description:	Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon).

Rule name:	Windows_Trojan_Metasploit_38b8ceec Create hunting rule
Author:	Elastic Security
Description:	Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon).

Rule name:	Windows_Trojan_Metasploit_47f5d54a Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Metasploit_7bc0f998 Create hunting rule
Description:	Identifies the API address lookup function leverage by metasploit shellcode

Rule name:	Windows_Trojan_Metasploit_7bc0f998 Create hunting rule
Author:	Elastic Security
Description:	Identifies the API address lookup function leverage by metasploit shellcode

Rule name:	Windows_Trojan_Metasploit_c9773203 Create hunting rule
Description:	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:	https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm

Rule name:	Windows_Trojan_Metasploit_c9773203 Create hunting rule
Author:	Elastic Security
Description:	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:	https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Meterpreter

exe 9dacc222fdbcf8535cc003638cb89f1042ac199cc1fc1e1e4867426a90229c05

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3606535/

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/22057/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample