MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff60d1192ed2528d8aa29cfcd235fbbe74002e0e7048678be47822ff36bc02c5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ff60d1192ed2528d8aa29cfcd235fbbe74002e0e7048678be47822ff36bc02c5
SHA3-384 hash:	2df049a17766912ad6487106d8924fd45a4c0920db6128f78826d97c0804c378fda2f866cde8d6fdb0b0295393e1456b
SHA1 hash:	af2abfbd502e167cb633d6cff5d1de10099c0fd0
MD5 hash:	7f797ff6b5103adfe5a78cd351adecac
humanhash:	lactose-vegan-magnesium-aspen
File name:	Extension.zip
Download:	download sample
Signature	Metasploit Alert Create hunting rule
File size:	44'420 bytes
First seen:	2024-09-05 04:26:51 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
Note:	This file is a password protected archive. The password is: infected
ssdeep	768:fhF8UEAjGgaRd9Tnxp8zXjvGAkrfdV8tYd9YMtQmhcguqQjydKgfX52Llp63wjgE:fQgj/ab9jxp8zzfk7dSt2thKgKydKgfq
TLSH	T1FA13017B1E653195EAA714BDCA410F04F75321A1ABB72E7058A892D0EF5F88582B3D33
Magika	zip
Reporter	lontze7
Tags:	Metasploit

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

221

Origin country :

FR

File Archive Information

This file is a password protected archive. The password is: infected

This file archive contains 1 file(s), sorted by their relevance:

Relevant files 1

File name:	Extension.exe
File size:	73'802 bytes
SHA256 hash:	6c6b3b54df7b7e2e98add3b1cdd473964ac8d3baa8e5830d1f809d36caf0775a
MD5 hash:	27ab28561e126d51bbcb1ce43b9c045b
MIME type:	application/x-dosexec
Signature	Metasploit

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66d93322f3d7ccf99f90066d

Tags:

Encryption Static

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

PE File

Link:

https://app.docguard.net/ff60d1192ed2528d8aa29cfcd235fbbe74002e0e7048678be47822ff36bc02c5/results/dashboard

FileScan.io

Gathering data

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/ff60d1192ed2528d8aa29cfcd235fbbe74002e0e7048678be47822ff36bc02c5

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/ff60d1192ed2528d8aa29cfcd235fbbe74002e0e7048678be47822ff36bc02c5

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ff60d1192ed2528d8aa29cfcd235fbbe74002e0e7048678be47822ff36bc02c5/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=75qncgjo2jji3cvctt6nenp3xz2aalqoobegpc7eparp6nv4alcq._file

Hatching Triage metasploit

Result

Malware family:

metasploit

Alert

Create hunting rule

Score:

  10/10

Tags:

family:metasploit backdoor discovery trojan

Link:

https://tria.ge/reports/240905-ftprzavbqa/

Behaviour

System Location Discovery: System Language Discovery

MetaSploit

Malware Config

C2 Extraction:

http://89.197.154.115:7700/JxVmIKqquDETqxKqdQESdAttyu5vWAJluglSK4rCFcy7dSsklIMatfCt0AYaTE4t4cwlrwSMZHW0MK2RyvODHcO_aHJ1xfPl9I6WOSWFt6fc0uDMIXvAu36bzTtzmmt6aYXURHsQSxmYBy7yw21ND2D3CSsQ0FuFAYzSGWG_GdvRLdO3VfJafrfsUzocxm8lTHOQcJ

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ff60d1192ed2528d8aa29cfcd235fbbe74002e0e7048678be47822ff36bc02c5