MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb81ff9e9a7de7bd80fe0ab14f44bb84c888804b5eeaab6212c039037d342d8d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Meterpreter

Vendor detections: 13

Intelligence 13 IOCs YARA 21 File information Comments

SHA256 hash:	fb81ff9e9a7de7bd80fe0ab14f44bb84c888804b5eeaab6212c039037d342d8d
SHA3-384 hash:	12c91d275b377bac6db181b5d569815cc1106b0d1cc157baeaca0d2c093d9ba804cc110717d9ebea7c5e27aaa2278057
SHA1 hash:	973aff40462524b9ae8a62016e5bee1fc2c68a20
MD5 hash:	15a858cb50dee39651bfd143c1383f5e
humanhash:	oranges-washington-winner-alabama
File name:	srv_lan.exe
Download:	download sample
Signature	Meterpreter Create hunting rule
File size:	251'904 bytes
First seen:	2026-09-25 19:20:48 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	c2d02fc98f1d75d7b9457468ec75da0e (28 x Meterpreter, 3 x Metasploit)
ssdeep	6144:Z0KiW6orphb7vHZ6niPvAO/qmq7jplEvA:Z0ePphnPZcBu3Ejpiv
TLSH	T1C0347D4A76A41C6AEDB7823EC9534A0AD7F2B8020751C7CF07A443AB6F177D1663E721
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	BlinkzSec
Tags:	Meterpreter

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/ca5611bf-78f7-42f8-b6e3-327c67e4370c/

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-09-25 19:27:03 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/e56f272e-42ea-411b-8bf2-77ea56d1cc42

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Meterpreter

Link:

https://www.capesandbox.com/analysis/89034/

Detection(s):

Win.Exploit.D388a-9756522-0

Win.Exploit.Meterpreter-9777172-0

YARA.DITEKSHEN_MALWARE_Win_Meterpreter.UNOFFICIAL

SecuriteInfo.com.Variant.Application.tedy.2261.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Connection attempt

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

crypto exploit microsoft_visual_cc packed

Link:

https://www.filescan.io/uploads/6ab6cb8fb231515463a01815/reports/e47839ee-e925-4c26-b9e0-04a876d81b1f/overview

Verdict:

Malicious

Labled as:

Dump:Generic.Beacon.Marte.B

Link:

https://www.hybrid-analysis.com/sample/fb81ff9e9a7de7bd80fe0ab14f44bb84c888804b5eeaab6212c039037d342d8d

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-09-25T18:57:00Z UTC

Last seen:

2026-09-26T22:07:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/fb81ff9e9a7de7bd80fe0ab14f44bb84c888804b5eeaab6212c039037d342d8d/results?tab=lookup

Malware family:

Metasploit Framework

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/5e667c77-af23-4edc-ab52-961e799d43ef

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/fb81ff9e9a7de7bd80fe0ab14f44bb84c888804b5eeaab6212c039037d342d8d

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/15a858cb50dee39651bfd143c1383f5e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fb81ff9e9a7de7bd80fe0ab14f44bb84c888804b5eeaab6212c039037d342d8d/

Threat name:

Win64.Infostealer.Tinba

Status:

Malicious

First seen:

2026-09-25 19:18:08 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

19 of 24 (79.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7oa77hu2pxt33ah6bkyu6rf3qteiracll3vkwyqsya4qg7jufwgq._file

Verdict:

malicious

Label(s):

Metasploit

Link:

https://reports.threatray.com/63101de3-fdd8-4161-ae8e-7a2c005f6af1

Result

Malware family:

n/a

Score:

3/10

Tags:

discovery

Link:

https://tria.ge/reports/260925-x2sbhavdjh/

Behaviour

Reads the TCP/IP host and domain name from the registry

Unpacked files

SH256 hash:

fb81ff9e9a7de7bd80fe0ab14f44bb84c888804b5eeaab6212c039037d342d8d

MD5 hash:

15a858cb50dee39651bfd143c1383f5e

SHA1 hash:

973aff40462524b9ae8a62016e5bee1fc2c68a20

Detections:

triage_cobaltstrike_sc_rot13

triage_meterpreter

Link:

https://www.unpac.me/results/a969b1aa-ed02-4d44-82ed-9307f6cc1e47/

SH256 hash:

ee12e52be2ee08df2af0f9c4bc7d66bfa8a0df87af5366723ac1dc63000c1e39

MD5 hash:

d82f0f7c02492c267d9a3c2cfe16d9b3

SHA1 hash:

34f557fcc33512535202b0391ff6a81256d8df10

Detections:

triage_cobaltstrike_sc_rot13

triage_meterpreter

MALWARE_Win_Meterpreter

Link:

https://www.unpac.me/results/a969b1aa-ed02-4d44-82ed-9307f6cc1e47/

Parent samples :

452f2dc26a3f958d9c854ff256e56c78cf004d6d53660b6b6294cb2e2e522033
33a4efae8ea37b66a9e13b5d87aff9e18a96141522f4681b29a56c369625dfe9
fb81ff9e9a7de7bd80fe0ab14f44bb84c888804b5eeaab6212c039037d342d8d

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.77

Link:

https://yomi.yoroi.company/submissions/fb81ff9e9a7de7bd80fe0ab14f44bb84c888804b5eeaab6212c039037d342d8d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MALWARE_Win_Meterpreter Create hunting rule
Author:	ditekSHen
Description:	Detects Meterpreter payload

Rule name:	meth_peb_parsing Create hunting rule
Author:	Willi Ballenthin

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	Windows_Trojan_Metasploit_0cc81460 Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Metasploit_38b8ceec Create hunting rule
Description:	Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon).

Rule name:	Windows_Trojan_Metasploit_38b8ceec Create hunting rule
Author:	Elastic Security
Description:	Identifies the API address lookup function used by metasploit. Also used by other tools (like beacon).

Rule name:	Windows_Trojan_Metasploit_7bc0f998 Create hunting rule
Description:	Identifies the API address lookup function leverage by metasploit shellcode

Rule name:	Windows_Trojan_Metasploit_7bc0f998 Create hunting rule
Author:	Elastic Security
Description:	Identifies the API address lookup function leverage by metasploit shellcode

Rule name:	Windows_Trojan_Metasploit_c9773203 Create hunting rule
Description:	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:	https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm

Rule name:	Windows_Trojan_Metasploit_c9773203 Create hunting rule
Author:	Elastic Security
Description:	Identifies the 64 bit API hashing function used by Metasploit. This has been re-used by many other malware families.
Reference:	https://github.com/rapid7/metasploit-framework/blob/04e8752b9b74cbaad7cb0ea6129c90e3172580a2/external/source/shellcode/windows/x64/src/block/block_api.asm