Trojan.Metasploit
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 10,466 |
| Threat Level: | 90 % (High) |
| Infected Computers: | 152 |
| First Seen: | July 24, 2009 |
| Last Seen: | June 14, 2026 |
| OS(es) Affected: | Windows |
The detection of Trojan.Metasploit on your system indicates a potential security threat that requires immediate attention. Trojan-type threats are known for their ability to disguise themselves as legitimate software, making them difficult to detect and remove. In this report, we will provide an overview of the threat, its operating methods, symptoms of infection, and steps to remove it from your system.
Table of Contents
What Is Trojan.Metasploit?
Trojan.Metasploit is a type of malware that can compromise the security of your system. The name "Trojan" refers to the fact that this type of malware can masquerade as legitimate software, allowing it to evade detection and gain access to your system. The term "Metasploit" is associated with a known exploit framework, which suggests that this threat may be using vulnerabilities in software to infect systems.
How Trojan.Metasploit Operates
Trojan.Metasploit, like other Trojan-type threats, operates by exploiting vulnerabilities in software or tricking users into installing it. Once installed, it can allow unauthorized access to your system, steal sensitive information, or disrupt system operations. The exact methods used by Trojan.Metasploit can vary, but its primary goal is to compromise the security and integrity of your system.
Symptoms of Infection
Symptoms of a Trojan.Metasploit infection can be subtle and may not always be immediately apparent. However, common indicators of a Trojan infection include unusual system behavior, slow performance, frequent crashes, or the appearance of unwanted programs or pop-ups. If you suspect that your system is infected, it is crucial to take immediate action to prevent further damage.
How to Remove Trojan.Metasploit
- Boot your system in Safe Mode with Networking to prevent the malware from loading and to allow for internet access for updates and downloads.
- Download and install a reputable anti-malware tool, such as SpyHunter, and perform a full scan of your system to detect and remove all instances of the malware.
- Uninstall any suspicious programs that were installed around the time of the infection. Be cautious and only remove programs that you are certain are malicious or unnecessary.
- Reset your web browsers (Chrome, Firefox, Edge) to their default settings to remove any malicious extensions or settings that the malware may have altered.
- Reboot your system and perform another full scan with your anti-malware tool to ensure that all remnants of the malware have been removed.
Conclusion
The removal of Trojan.Metasploit from your system requires careful and immediate action. By following the steps outlined in this report, you can help ensure the removal of this threat and protect your system from future infections. It is also important to maintain good security practices, such as regularly updating your software, using strong antivirus programs, and being cautious when installing new software or opening email attachments from unknown sources. Remember, vigilance and proactive measures are key to protecting your digital security.
Analysis Report
General information
| Family Name: | Trojan.Metasploit |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
7474230f355b41762473804215167e2a
SHA1:
53dc78cfa5852746b8c9be18636edb42b853cd8e
File Size:
73.80 KB, 73802 bytes
|
|
MD5:
d446185d1a839ca025c784ba8a9f9b29
SHA1:
37c369315ee75f2d63e997bdc59b6d00ffeafa83
SHA256:
D0599BBEF2EF2DB10709388570A50A344653B81EC2F78E8D1A53BBCB1F78A452
File Size:
23.04 KB, 23040 bytes
|
|
MD5:
52878057f94af70d1068d897b9338d90
SHA1:
be2675849276eb5426159dea4a7b9d6df10ab017
SHA256:
47A7FC1CD186020A693FC35671C30F17EFB081596210521844768720AEEB599E
File Size:
73.80 KB, 73802 bytes
|
|
MD5:
cc26f137fe6b6ee19a107c2094246149
SHA1:
1fc0d2c9853cf809ef10d82fe002e050b47b69dd
SHA256:
B0EDCA873043928F2179FF5F2888171ECF94C8D1D88FD995F1794CC17FEA4F99
File Size:
1.58 MB, 1579008 bytes
|
|
MD5:
7101aee96c364f705b69fb9ae3c41c45
SHA1:
acc35b43097135a64bba10273a8e8e43586604ef
SHA256:
B171B972E191906645BE5D73ED95F4096D172BB0D1708FAAC54CBB42FBD84BF4
File Size:
73.80 KB, 73802 bytes
|
Show More
|
MD5:
bbc1b87d4b0b364bda7059d40954cc30
SHA1:
d5b8719d2a2c780053feab7fb3e5dc0b9b44bc0c
SHA256:
FAD59CB71FEB268FF8F154AAA75028FD3139A12D1729BFD4A3CDCC43035AC873
File Size:
22.53 KB, 22528 bytes
|
|
MD5:
fdf73e11ae55c2ed86441b2f8e14f6c9
SHA1:
c11bbb577c9121a2f797d746008f6546ab5d1c3c
SHA256:
8CE2547846C811AADB1E8C9FA06A754A02DA68F8E5E12A4BB77BF7BA9CA529BF
File Size:
29.18 KB, 29184 bytes
|
|
MD5:
a67b444830c94b499a1d85a3daf03437
SHA1:
c9d219bc378c099004b859644431c347f4db57d8
SHA256:
DE5A50E47247793728A0A776D6BD42747204C07A9973847AE98BA9D826A6A0EC
File Size:
245.85 KB, 245852 bytes
|
|
MD5:
94b6618ea933212e71848315f22f2077
SHA1:
3d29ce5b65cb25a33b22e52a93d70bca48b9cad8
SHA256:
540D9553D9A0B0D6D125237AB1ADA0735C52FA3B4051816723CF094102981B4F
File Size:
245.85 KB, 245852 bytes
|
|
MD5:
cbce5bd1d4ff56aeed4f61860499cd0b
SHA1:
af4ae935d64fa32864dad73ad6780293cc61d271
SHA256:
3BE31C82741213A813D9068977A98AE39269F726DCC38C6A4D61F37A8C5FEB60
File Size:
7.68 KB, 7680 bytes
|
|
MD5:
812fa742ecf295f62588f78d617d187e
SHA1:
6072f8e52290be13d423ac6b8534f470b848761b
SHA256:
EE0B4485453E02E91BAB22137C912591D10206CEDC211F35CEA737B338D733B2
File Size:
2.08 MB, 2082816 bytes
|
|
MD5:
7c6bc7727ad472ba442f11949984ece0
SHA1:
dcfde6f44f21f92a228c132a02dc15d53aa09c63
SHA256:
27AC570ACFD621D2BC766B1038FC319C9975961F69F76EC6C51E8FA385CA6BDB
File Size:
307.20 KB, 307200 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have resources
- File doesn't have security information
- File has exports table
- File has TLS information
- File is .NET application
- File is 32-bit executable
Show More
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version | 1.0.0.0 |
| Comments |
|
| Company Name |
|
| File Description |
|
| File Version |
|
| Internal Name |
|
| Legal Copyright |
|
| Legal Trademarks | Copyright © 2016-2023 Outbyte Computing Pty Ltd |
| Original Filename |
|
| Product Name |
|
| Product Version |
|
File Traits
- .NET
- 2+ executable sections
- Agile.net
- CryptUnprotectData
- dll
- Fody
- HighEntropy
- imgui
- No Version Info
- ntdll
Show More
- WriteProcessMemory
- x64
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 931 |
|---|---|
| Potentially Malicious Blocks: | 292 |
| Whitelisted Blocks: | 495 |
| Unknown Blocks: | 144 |
Visual Map
x
x
x
0
x
x
x
x
x
0
x
0
x
x
x
0
x
x
x
x
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
x
x
0
x
x
x
0
x
x
0
x
0
x
x
x
x
x
x
x
x
0
x
0
0
0
0
0
x
0
0
0
x
0
x
0
0
x
x
x
x
0
x
0
0
0
0
0
0
0
x
x
x
0
0
0
x
x
0
x
x
x
0
x
0
x
x
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
x
0
0
0
0
0
0
x
0
x
x
0
0
x
0
x
0
x
0
0
0
0
x
x
x
x
0
0
0
0
x
0
x
0
x
x
x
x
0
0
0
0
0
x
0
x
x
x
x
x
x
x
?
x
x
0
x
x
x
x
0
?
x
?
?
?
x
?
x
x
x
?
?
?
?
?
?
?
x
0
x
0
x
x
x
x
x
x
x
x
x
0
0
0
?
x
x
0
x
?
?
?
x
x
?
x
?
?
0
x
x
x
x
x
x
x
x
?
?
x
x
x
x
x
?
x
x
?
?
?
0
?
?
?
?
x
x
x
x
?
?
?
x
?
x
x
x
x
x
x
x
x
x
x
x
x
?
x
x
?
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
0
0
?
0
?
?
x
x
x
x
x
?
?
x
?
?
x
?
?
?
x
x
x
x
x
x
x
x
?
x
?
?
?
x
x
?
x
0
x
x
?
?
x
0
x
x
x
x
x
?
x
?
?
x
?
?
x
?
?
?
?
?
x
?
0
x
x
x
x
x
0
0
x
x
x
x
x
x
x
x
0
x
x
x
x
x
0
x
?
x
0
x
0
0
x
?
x
x
x
x
0
?
x
x
x
0
0
x
x
?
x
x
?
x
x
x
x
x
x
x
?
?
?
x
x
?
x
x
x
0
x
x
x
x
0
0
x
x
0
x
x
x
x
x
x
?
?
x
x
?
x
x
0
x
x
?
?
?
x
x
x
x
?
x
?
x
?
x
?
?
?
?
x
x
x
x
?
0
?
0
?
?
x
x
?
?
?
x
x
x
x
x
x
?
x
0
?
?
x
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
?
?
?
x
x
x
?
?
x
?
0
0
0
0
0
x
x
x
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
1
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
1
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
1
0
0
1
0
0
0
0
1
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.XXS
- CobaltStrike.A
- Donut.G
- MSIL.Downloader.Agent.BIG
- MSIL.Metasploit.A
Show More
- MSIL.SharpGPOAbuse.B
- MSIL.SharpS.B
- Rozena.UE
- Rozena.XAA
- Swrort.A
- Swrort.AB
- Swrort.AE
- Trojan.Metasploit.Gen.A
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 똃ﴮමǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 똃ﴮමǜ | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
26 additional items are not displayed above. |
| User Data Access |
|
| Process Shell Execute |
|
| Anti Debug |
|
| Process Terminate |
|
| Process Manipulation Evasion |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
"cmd.exe" /c ""c:\users\user\downloads\37c369315ee75f2d63e997bdc59b6d00ffeafa83_0000023040" exploit all"
|
WriteConsole: '"c:\users\user\
|
WriteConsole: file.
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\1fc0d2c9853cf809ef10d82fe002e050b47b69dd_0001579008.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\c11bbb577c9121a2f797d746008f6546ab5d1c3c_0000029184.,LiQMAxHB
|
