popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

payload.exe

Metasploit Generic Malware PE64 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 4, 2024, 10:05 a.m. Sept. 4, 2024, 10:17 a.m.
Size 7.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 ca6ae34bf2b35aacb25a27f94fb1f7d5
SHA256 fc69cdadc5ef79a1ba2b40189ecd6af230b7d9e8076f98f9fbb7a880b2b1b236
CRC32 B0AD1B8C
ssdeep 24:eFGStrJ9u0/6RPnZdkBQAV2oYjGKLqAgeNDMSCvOXpmB:is0UrkBQvCggSD9C2kB
Yara
  • Windows_Trojan_Metasploit_91bc5d7d - (no description)
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • Generic_Malware_Zero - Generic Malware

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
144.34.162.13 Active Moloch
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .lhjl
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
EnterCriticalSection+0x1e ExitThread-0x19 kernel32+0xaa404 @ 0x76cba404
payload+0x41fe @ 0x1400041fe
0x7fffffdf250
0x12f708
0x12f740
payload+0x41fe @ 0x1400041fe
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58
0x58

exception.instruction_r: 4e 54 44 4c 4c 2e 52 74 6c 45 78 69 74 55 73 65
exception.symbol: EnterCriticalSection+0x1e ExitThread-0x19 kernel32+0xaa404
exception.instruction: push rsp
exception.module: kernel32.dll
exception.exception_code: 0xc0000005
exception.offset: 697348
exception.address: 0x76cba404
registers.r14: 0
registers.r15: 0
registers.rcx: 0
registers.rsi: 0
registers.r10: 5368726014
registers.rbx: 0
registers.rsp: 1244152
registers.r11: 514
registers.r8: 1242888
registers.r9: 1242944
registers.rdx: 8796092887632
registers.r12: 1244576
registers.rbp: 5368725514
registers.rdi: 88
registers.rax: 1993057284
registers.r13: 1244584
1 0 0
host 144.34.162.13
Bkav W64.AIDetectMalware
Lionic Trojan.Win32.Metasploit.4!c
Elastic Windows.Trojan.Metasploit
Cynet Malicious (score: 100)
CAT-QuickHeal HackTool.Metasploit.S9212471
Skyhigh BehavesLike.Win64.Infected.zz
ALYac Trojan.Metasploit.A
Cylance Unsafe
VIPRE Trojan.Metasploit.A
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Trojan ( 004fae881 )
BitDefender Trojan.Metasploit.A
K7GW Trojan ( 004fae881 )
Cybereason malicious.bf2b35
Arcabit Trojan.Metasploit.A
VirIT Trojan.Win32.Generic.BZPS
Symantec Meterpreter
ESET-NOD32 a variant of Win64/Rozena.M
APEX Malicious
McAfee Trojan-FJIN!CA6AE34BF2B3
Avast Win32:MsfShell-V [Hack]
ClamAV Win.Malware.Metasploit-10022275-0
Kaspersky HEUR:Trojan.Win64.Packed.gen
Alibaba Trojan:Win32/CobaltStrike.5f03
SUPERAntiSpyware Trojan.Agent/Gen-MalPack
MicroWorld-eScan Trojan.Metasploit.A
Rising Trojan.Kryptik/x64!1.A2F4 (CLASSIC)
Emsisoft Trojan.Metasploit.A (B)
F-Secure Trojan.TR/Crypt.XPACK.Gen7
DrWeb BackDoor.Shell.244
McAfeeD Real Protect-LS!CA6AE34BF2B3
Trapmine malicious.high.ml.score
FireEye Generic.mg.ca6ae34bf2b35aac
Sophos ATK/Meter-A
SentinelOne Static AI - Malicious PE
Jiangmin Trojan.Generic.auyjj
Webroot W32.Trojan.Gen
Google Detected
Avira TR/Crypt.XPACK.Gen7
MAX malware (ai score=80)
Antiy-AVL GrayWare/Win32.Rozena.j
Kingsoft Win64.Trojan.Packed.gen
Gridinsoft Trojan.Win64.Gen.tr
Microsoft Trojan:Win64/Metasploit!pz
ViRobot Trojan.Win.Z.Metasploit.7168.FCN
ZoneAlarm HEUR:Trojan.Win64.Packed.gen
GData Win32.Backdoor.Rozena.SGQFVT
Varist W64/Rozena.IG
AhnLab-V3 Trojan/Win32.RL_Generic.R357794
Acronis suspicious
dead_host 192.168.56.101:49161
dead_host 144.34.162.13:3333