Trojan.Metasploit
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 6,936 |
| Threat Level: | 90 % (High) |
| Infected Computers: | 145 |
| First Seen: | July 24, 2009 |
| Last Seen: | April 20, 2026 |
| OS(es) Affected: | Windows |
Table of Contents
Analysis Report
General information
| Family Name: | Trojan.Metasploit |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
7474230f355b41762473804215167e2a
SHA1:
53dc78cfa5852746b8c9be18636edb42b853cd8e
File Size:
73.80 KB, 73802 bytes
|
|
MD5:
d446185d1a839ca025c784ba8a9f9b29
SHA1:
37c369315ee75f2d63e997bdc59b6d00ffeafa83
SHA256:
D0599BBEF2EF2DB10709388570A50A344653B81EC2F78E8D1A53BBCB1F78A452
File Size:
23.04 KB, 23040 bytes
|
|
MD5:
52878057f94af70d1068d897b9338d90
SHA1:
be2675849276eb5426159dea4a7b9d6df10ab017
SHA256:
47A7FC1CD186020A693FC35671C30F17EFB081596210521844768720AEEB599E
File Size:
73.80 KB, 73802 bytes
|
|
MD5:
cc26f137fe6b6ee19a107c2094246149
SHA1:
1fc0d2c9853cf809ef10d82fe002e050b47b69dd
SHA256:
B0EDCA873043928F2179FF5F2888171ECF94C8D1D88FD995F1794CC17FEA4F99
File Size:
1.58 MB, 1579008 bytes
|
|
MD5:
7101aee96c364f705b69fb9ae3c41c45
SHA1:
acc35b43097135a64bba10273a8e8e43586604ef
SHA256:
B171B972E191906645BE5D73ED95F4096D172BB0D1708FAAC54CBB42FBD84BF4
File Size:
73.80 KB, 73802 bytes
|
Show More
|
MD5:
bbc1b87d4b0b364bda7059d40954cc30
SHA1:
d5b8719d2a2c780053feab7fb3e5dc0b9b44bc0c
SHA256:
FAD59CB71FEB268FF8F154AAA75028FD3139A12D1729BFD4A3CDCC43035AC873
File Size:
22.53 KB, 22528 bytes
|
|
MD5:
fdf73e11ae55c2ed86441b2f8e14f6c9
SHA1:
c11bbb577c9121a2f797d746008f6546ab5d1c3c
SHA256:
8CE2547846C811AADB1E8C9FA06A754A02DA68F8E5E12A4BB77BF7BA9CA529BF
File Size:
29.18 KB, 29184 bytes
|
|
MD5:
a67b444830c94b499a1d85a3daf03437
SHA1:
c9d219bc378c099004b859644431c347f4db57d8
SHA256:
DE5A50E47247793728A0A776D6BD42747204C07A9973847AE98BA9D826A6A0EC
File Size:
245.85 KB, 245852 bytes
|
|
MD5:
94b6618ea933212e71848315f22f2077
SHA1:
3d29ce5b65cb25a33b22e52a93d70bca48b9cad8
SHA256:
540D9553D9A0B0D6D125237AB1ADA0735C52FA3B4051816723CF094102981B4F
File Size:
245.85 KB, 245852 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have resources
- File doesn't have security information
- File has exports table
- File is .NET application
- File is 32-bit executable
- File is 64-bit executable
Show More
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version | 1.0.0.0 |
| Comments |
|
| Company Name |
|
| File Description |
|
| File Version |
|
| Internal Name |
|
| Legal Copyright |
|
| Legal Trademarks | Copyright © 2016-2023 Outbyte Computing Pty Ltd |
| Original Filename |
|
| Product Name |
|
| Product Version |
|
File Traits
- .NET
- 2+ executable sections
- Agile.net
- CryptUnprotectData
- dll
- Fody
- HighEntropy
- ntdll
- WriteProcessMemory
- x64
Show More
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 899 |
|---|---|
| Potentially Malicious Blocks: | 199 |
| Whitelisted Blocks: | 506 |
| Unknown Blocks: | 194 |
Visual Map
x
x
x
x
x
x
x
x
x
x
x
0
0
x
x
x
x
x
x
x
x
x
x
x
x
?
x
x
x
x
x
?
x
x
x
x
x
x
?
?
?
?
?
x
x
x
x
x
0
0
x
x
x
x
x
x
x
x
x
0
x
0
x
x
x
x
x
x
x
x
x
x
0
0
x
x
x
0
x
x
x
x
0
0
x
x
x
x
x
x
0
x
x
x
x
x
x
x
?
x
x
x
?
x
?
x
?
x
x
x
x
?
x
?
?
?
x
x
x
?
x
x
x
x
x
x
x
x
?
?
?
?
?
0
0
0
0
x
x
x
0
x
0
?
x
x
?
?
x
?
?
?
?
?
?
?
?
x
?
x
x
x
?
0
x
0
?
x
x
0
x
x
x
?
x
x
x
x
x
x
x
x
x
?
x
0
0
?
x
x
x
x
?
x
?
?
?
?
0
x
?
?
?
0
?
x
0
x
0
?
x
?
x
?
x
x
x
x
?
?
?
x
?
?
?
?
x
x
x
x
x
x
x
x
x
x
x
x
x
?
?
?
x
?
?
x
x
?
?
x
?
?
x
x
?
?
x
x
x
x
x
x
?
0
0
x
?
0
0
?
?
0
?
0
x
x
?
0
x
x
x
x
x
x
x
0
x
0
x
x
x
0
0
0
0
0
0
?
0
x
?
x
?
x
x
0
?
?
x
x
x
x
0
?
0
x
x
0
?
x
0
x
0
x
x
0
0
0
0
0
?
?
x
x
0
0
?
0
0
0
0
x
0
0
?
?
0
?
0
?
?
?
?
?
?
?
0
0
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
x
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
0
2
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.XXS
- MSIL.Downloader.Agent.BIG
- MSIL.Metasploit.A
- MSIL.SharpGPOAbuse.B
- MSIL.SharpS.B
Show More
- Swrort.A
- Swrort.AB
- Swrort.AE
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 똃ﴮමǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 똃ﴮමǜ | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
25 additional items are not displayed above. |
| User Data Access |
|
| Process Shell Execute |
|
| Anti Debug |
|
| Process Terminate |
|
| Process Manipulation Evasion |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
"cmd.exe" /c ""c:\users\user\downloads\37c369315ee75f2d63e997bdc59b6d00ffeafa83_0000023040" exploit all"
|
WriteConsole: '"c:\users\user\
|
WriteConsole: file.
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\1fc0d2c9853cf809ef10d82fe002e050b47b69dd_0001579008.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\c11bbb577c9121a2f797d746008f6546ab5d1c3c_0000029184.,LiQMAxHB
|
