MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ae1437499b1cf946f087c80235612ac9f723b4d3c95df55f0f8a25921b9e8e42. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Metasploit


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ae1437499b1cf946f087c80235612ac9f723b4d3c95df55f0f8a25921b9e8e42
SHA3-384 hash: b6a8fb03d80c59ec124ef0fa2aad7a405f6b645f81e2206663ede66025b86dcfce3d0cefdb46dace84604d59fd967a12
SHA1 hash: 80ce60691391ac27a9967a9210545efaebdb5b84
MD5 hash: 995fa07875f6b01dc20635a3d6b6e262
humanhash: yankee-artist-mississippi-lithium
File name:995fa07875f6b01dc20635a3d6b6e262
Download: download sample
Signature Metasploit
Create hunting rule
File size:73'802 bytes
First seen:2022-02-16 12:07:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 481f47bbb2c9c21e108d65f52b04c448 (257 x Meterpreter, 93 x Metasploit, 33 x ShikataGaNai)
ssdeep 1536:IuVmymu37u2MjHt8JlJHiEAvxoMb+KR0Nc8QsJq39:9VmyD3kjHt8F7e0Nc8QsC9
TLSH T15C73BF42D9C45035C066227E27B93BB5A9B1F6BB7200D1CE7A4CCEE5DBC19B0B6263C5
Reporter zbetcheckin
Tags:32 exe Metasploit

Intelligence

File Origin
# of uploads :
1
# of downloads :
253
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/241902/
Detection(s):
Win.Trojan.Swrort-5710536-0
Create hunting rule

BC.Win.Trojan.Swrort-17210
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
cobalt greyware meterpreter overlay packed rozena swrort virus
Link:
https://www.filescan.io/uploads/620ce928ac8ad0468b46b62f/reports/7cf8c9cb-d2f4-4ec0-83a4-4e525ee1a77b/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d9e0fd5e-1da5-4707-9665-a3a5b8706218
Result
Threat name:
Metasploit
Create hunting rule
Detection:
malicious
Classification:
troj
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/940783
Signature
Antivirus / Scanner detection for submitted sample
Found malware configuration
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Yara detected Metasploit Payload
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ae1437499b1cf946f087c80235612ac9f723b4d3c95df55f0f8a25921b9e8e42/
Threat name:
Win32.Trojan.Swrort
Create hunting rule
Status:
Malicious
First seen:
2022-02-16 12:08:09 UTC
File Type:
PE (Exe)
AV detection:
27 of 28 (96.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vykdosm3dt4un4ehzabdkyjkzh3shngtzfo7kxypriszeg46rzba._file
Verdict:
malicious
Result
Malware family:
metasploit
Create hunting rule
Score:
  10/10
Tags:
family:metasploit backdoor trojan
Link:
https://tria.ge/reports/220216-pawwlsbfe2/
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious use of AdjustPrivilegeToken
Drops file in Windows directory
MetaSploit
Malware Config
C2 Extraction:
212.227.160.162:4444
Unpacked files
SH256 hash:
ae1437499b1cf946f087c80235612ac9f723b4d3c95df55f0f8a25921b9e8e42
MD5 hash:
995fa07875f6b01dc20635a3d6b6e262
SHA1 hash:
80ce60691391ac27a9967a9210545efaebdb5b84
Link:
https://www.unpac.me/results/534b4b97-3664-491a-b1d9-e5b68c92032a/
Malware family:
Metasploit
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ae1437499b1c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ae1437499b1cf946f087c80235612ac9f723b4d3c95df55f0f8a25921b9e8e42

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:metasploit_rev_tcp_32
Create hunting rule
Author:Javier Rascon

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Metasploit

Executable exe ae1437499b1cf946f087c80235612ac9f723b4d3c95df55f0f8a25921b9e8e42

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2045237/
Cape
Cape
https://www.capesandbox.com/analysis/241902/

Comments


Avatar
zbet commented on 2022-02-16 12:07:37 UTC

url : hxxp://212.227.160.162/FREE_NITRO_GENERATOR_2022.exe