MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7b87b5f38edf515e63daf8e9d59fb3257c6dbb63d6f4b035e9bb94ca782346b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Meterpreter


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d7b87b5f38edf515e63daf8e9d59fb3257c6dbb63d6f4b035e9bb94ca782346b
SHA3-384 hash: e61e0707937eb7baa56708195499d9c55b08fc0ce64222754de02f2cef93b1c3c238efefad25df54c6e0c0035dcc6656
SHA1 hash: e74d4b72a7bbfa166072c1ae4c483c46b6d093a2
MD5 hash: d76cfe4727b88d9313ebc0baf18ede09
humanhash: low-winter-undress-florida
File name:d76cfe4727b88d9313ebc0baf18ede09.exe
Download: download sample
Signature Meterpreter
Create hunting rule
File size:175'616 bytes
First seen:2022-07-31 20:05:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3ecb187cd683feb2ed854734f0f22a22 (1 x Meterpreter)
ssdeep 3072:zzEdyuxR+56hF9r79Y9FSErK/bvh8KMQzi2R:XD5iF9rrrRi2R
Threatray 7 similar samples on MalwareBazaar
TLSH T1CD04F71AF3A320F9C15AC17556E753B2AA72BC301121AFBE8394EA712F64D917F2D710
TrID 38.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.5% (.EXE) OS/2 Executable (generic) (2029/13)
15.4% (.EXE) Clipper DOS Executable (2018/12)
15.2% (.EXE) Generic Win/DOS Executable (2002/3)
15.2% (.EXE) DOS Executable Generic (2000/1)
Reporter abuse_ch
Tags:exe Meterpreter


Avatar
abuse_ch
Meterpreter C2:
1.117.145.220:1145

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
1.117.145.220:1145 https://threatfox.abuse.ch/ioc/840630/

Intelligence

File Origin
# of uploads :
1
# of downloads :
398
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/295416/
Detection(s):
SecuriteInfo.com.BackDoor.Meterpreter.227.15472.4376.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/27932/overview
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug
Link:
https://www.filescan.io/uploads/62e6e0add40ca36661567fe2/reports/dec70a7c-c0e9-4344-8117-0ccac791b3a0/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Meterpreter
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4fcfd236-210b-452f-8ed5-f603a7115b60
Result
Threat name:
Meterpreter
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1043862
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to change the desktop window for a process (likely to hide graphical interactions)
Contains functionality to check if the process is started with administrator privileges
Contains functionality to inject code into remote processes
Contains functionality to inject threads in other processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected Meterpreter
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d7b87b5f38edf515e63daf8e9d59fb3257c6dbb63d6f4b035e9bb94ca782346b/
Threat name:
Win64.Trojan.Swrort
Create hunting rule
Status:
Malicious
First seen:
2022-07-28 15:24:52 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
20 of 25 (80.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=264hwxzy5x2rlzr5v6hj2wp3gjl4nw5whvxuwa26to4uzj4cgrvq._file
Verdict:
malicious
Similar samples:
1a0fe47068a27b22f4bf644c888b61f185a904b231632c6877e1be599e08a107
Meterpreter
555e3cf6a90d8bdb8fb1a5cf8dfb9357df47e6b4c23f0c6726ea8ded50238bc6
Meterpreter
cbcc9da9ec3bb25c5d91da1eb4d45f5ffc9a31cf38c9be9f7423be20499c8b17
Meterpreter
d3ec1a84996a4443b146bfeeaded02eafe663af47b858adc650465f808498eb4
Meterpreter
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220731-yvdp7sfdfr/
Unpacked files
SH256 hash:
d7b87b5f38edf515e63daf8e9d59fb3257c6dbb63d6f4b035e9bb94ca782346b
MD5 hash:
d76cfe4727b88d9313ebc0baf18ede09
SHA1 hash:
e74d4b72a7bbfa166072c1ae4c483c46b6d093a2
Link:
https://www.unpac.me/results/856ee648-f558-4301-bf45-127bdb8a68b8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Pay2Key
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d7b87b5f38edf515e63daf8e9d59fb3257c6dbb63d6f4b035e9bb94ca782346b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT_Lazarus_Loader_Dec_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect loader used by Lazarus group in december 2020
Reference:Internal Research
Rule name:MALWARE_Win_Meterpreter
Create hunting rule
Author:ditekSHen
Description:Detects Meterpreter payload
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_peb_parsing
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/295416/

Comments