MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d16eb8da5c5ce99f1a2e38677eff8d2ae532cb1ad0eddf10a311583004675960. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Metasploit

Vendor detections: 13

Intelligence 13 IOCs YARA 4 File information Comments

SHA256 hash:	d16eb8da5c5ce99f1a2e38677eff8d2ae532cb1ad0eddf10a311583004675960
SHA3-384 hash:	6ebab59947885b0e9ad6df9ac450933c68578da6fefeda23283dadd30b0ea80908fc498324e7b0f3ab06de46b1d73e77
SHA1 hash:	6ae0ff6690d0a857d145f671589a97620c1e43e5
MD5 hash:	1a679e0ccedfb2c3b8ebaf8d9b22f96a
humanhash:	papa-fourteen-white-magnesium
File name:	Meeting.sfx.exe
Download:	download sample
Signature	Metasploit Create hunting rule
File size:	298'443 bytes
First seen:	2024-09-05 04:26:38 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	fa8d20faea9ef7b4e2b7fbfe93442593 (17 x RedLineStealer, 4 x CoinMiner, 3 x AgentTesla)
ssdeep	6144:VN3DB60MGC1DI9cV2Qb91CWIoZu2pLM8jOiF6yX8CszJ:n3DkEGDINi1E/2G8tAyLYJ
TLSH	T12054BE21BAC184B1D9A619341AF1A732AB7CBC301B358ACF57442B1E9FB05D19F357A3
TrID	91.0% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 3.6% (.EXE) Win64 Executable (generic) (10523/12/4) 1.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.5% (.EXE) Win32 Executable (generic) (4504/4/1) 0.6% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
File icon (PE):
dhash icon	60dcc4c6c4c4c4d8 (1 x CobaltStrike, 1 x Metasploit)
Reporter	lontze7
Tags:	Metasploit

Intelligence

File Origin

# of uploads :

# of downloads :

110

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Meeting.sfx.exe

Verdict:

Malicious activity

Analysis date:

2024-09-05 04:27:35 UTC

Tags:

metasploit

Link:

https://app.any.run/tasks/696c49b4-7514-4d04-b591-08f18de53bab

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

BC.Win.Trojan.Swrort-17210

SecuriteInfo.com.Trojan.Uztuby.4.19274.32072.UNOFFICIAL

Win.Trojan.Swrort-5710536-0

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66d9331d8e12b8124ac942c5

Tags:

Encryption Infostealer Static Stealth Trojan

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Searching for the window

Сreating synchronization primitives

Searching for synchronization primitives

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

cobalt epmicrosoft_visual_cc fingerprint lolbin masquerade microsoft_visual_cc obfuscated overlay packed packed setupapi shdocvw shell32

Link:

https://www.filescan.io/uploads/66d9479ebe3a7c86222751de/reports/05cc0ded-4da1-4019-a857-04ab22831a30/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/d16eb8da5c5ce99f1a2e38677eff8d2ae532cb1ad0eddf10a311583004675960

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ea047c65-f6bd-4c54-bf06-8e935c7c22d3

Result

Threat name:

Metasploit

Detection:

malicious

Classification:

troj

Score:

96 / 100

Link:

https://www.joesandbox.com/analysis/1504623

Signature

Antivirus detection for dropped file

Found malware configuration

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Yara detected Metasploit Payload

Behaviour

Behavior Graph:

Download SVG

Score:

67%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/d16eb8da5c5ce99f1a2e38677eff8d2ae532cb1ad0eddf10a311583004675960

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d16eb8da5c5ce99f1a2e38677eff8d2ae532cb1ad0eddf10a311583004675960/

Threat name:

Win32.Backdoor.Meterpreter

Status:

Malicious

First seen:

2024-09-05 04:27:08 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2fxlrws4ltuz6grohbtx574nflstfsy22dw56efdcfmdabdhlfqa._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/240905-e234wssgmq/

Behaviour

Modifies Internet Explorer settings

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

System Location Discovery: System Language Discovery

Malware Family:

n/a

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/068d4c7f-62bd-4714-96c6-bc80e91bfb26

Unpacked files

SH256 hash:

9139b3a492dde19032bfae4b788be9b458febddad696af94d0161c32271f4085

MD5 hash:

d05f7cfee56f0331e756c6426337b5b5

SHA1 hash:

c3d622f49548f2a48da90e853dba168b0533b998

Detections:

CobaltStrike_Resources_Reverse_Bin_v2_5_through_v4_x

SUSP_Imphash_Mar23_2

CobaltStrike_Resources_Reverse_Bin_v2_5_through_v4_x

Link:

https://www.unpac.me/results/9106b537-d403-4200-9c2b-a4d7ac0ec43e/

SH256 hash:

d16eb8da5c5ce99f1a2e38677eff8d2ae532cb1ad0eddf10a311583004675960

MD5 hash:

1a679e0ccedfb2c3b8ebaf8d9b22f96a

SHA1 hash:

6ae0ff6690d0a857d145f671589a97620c1e43e5

Link:

https://www.unpac.me/results/9106b537-d403-4200-9c2b-a4d7ac0ec43e/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d16eb8da5c5ce99f1a2e38677eff8d2ae532cb1ad0eddf10a311583004675960

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Metasploit

exe d16eb8da5c5ce99f1a2e38677eff8d2ae532cb1ad0eddf10a311583004675960

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3157426/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Reviews

ID	Capabilities	Evidence
GDI_PLUS_API	Interfaces with Graphics	gdiplus.dll::GdiplusStartup gdiplus.dll::GdiplusShutdown gdiplus.dll::GdipAlloc
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryExA KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetSystemInfo KERNEL32.dll::GetStartupInfoW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::AllocConsole KERNEL32.dll::AttachConsole KERNEL32.dll::WriteConsoleW KERNEL32.dll::FreeConsole KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateFileW KERNEL32.dll::CreateFileMappingW KERNEL32.dll::DeleteFileW KERNEL32.dll::MoveFileW KERNEL32.dll::MoveFileExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample