MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10cc9b5c656363346600d1381d88fb8010ea3d04007d82de8bbde06c8786eace. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	10cc9b5c656363346600d1381d88fb8010ea3d04007d82de8bbde06c8786eace
SHA3-384 hash:	b2beb96f4422e77c26c911c71576f66ce05f4e0aa02b9b68b34b784f41779367c81b7482e21f0a113b0b528d78d3259d
SHA1 hash:	88757825cae400b38859489f08853fd6a0828086
MD5 hash:	d40756e973f6eb0e94aec6844289be7d
humanhash:	florida-idaho-twelve-november
File name:	file
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	4'822'616 bytes
First seen:	2026-02-03 14:31:10 UTC
Last seen:	2026-02-03 22:02:12 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	ae25b895c4627a172cd21c19ce29dcaf (1 x Smoke Loader)
ssdeep	98304:N8NDqaezr4Tqe7SaeO1ACFwkaZ9YuScU0dJPOhyhg:nzu7SDHOnKfEhog
TLSH	T1D526D0933F9E61FBFE4A21BD8014B26B969CFF7E46A50020E4D8584B5C470D23E1E95B
TrID	44.4% (.EXE) Win64 Executable (generic) (10522/11/4) 21.2% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.6% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	Bitsight
Tags:	dropped-by-amadey exe fbf543 signed Smoke Loader

Code Signing Certificate

Organisation:	FractalTechFlexible
Issuer:	FractalTechFlexible
Algorithm:	sha256WithRSAEncryption
Valid from:	2026-02-02T02:01:38Z
Valid to:	2028-02-03T02:01:38Z
Serial number:	2d0d4698eea15d7f
Thumbprint Algorithm:	SHA256
Thumbprint:	d7ac26f53c99a89205966e13102f92603c3542ddf36b696e1725f55c780dfb57
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Bitsight

url: http://130.12.180.43/files/8428202012/GfaGPyy.exe

Intelligence

File Origin

# of uploads :

# of downloads :

106

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

file.exe

Verdict:

Malicious activity

Analysis date:

2026-02-03 14:40:20 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/2c989008-5821-482a-a46f-8f85970d2241

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/51491/

Verdict:

Malicious

Score:

94.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6982074087f81e55ffeef5d6

Tags:

injection obfusc virus

Result

Verdict:

Clean

Maliciousness:

Behaviour

Сreating synchronization primitives

Using the Windows Management Instrumentation requests

Connection attempt

Sending an HTTP POST request

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug installer-heuristic keylogger packed signed

Link:

https://www.filescan.io/uploads/698206cf930564ff3c86f3e0/reports/832dd306-9650-4f6f-87da-50292482c3a5/overview

Verdict:

Malicious

Labled as:

Lazy.Generic

Link:

https://www.hybrid-analysis.com/sample/10cc9b5c656363346600d1381d88fb8010ea3d04007d82de8bbde06c8786eace

Result

Gathering data

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/46684438-f7af-447b-bc80-bb3dd135efe6

Score:

51%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/10cc9b5c656363346600d1381d88fb8010ea3d04007d82de8bbde06c8786eace

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/10cc9b5c656363346600d1381d88fb8010ea3d04007d82de8bbde06c8786eace/

Verdict:

Malicious

Threat:

Family.SMOKE LOADER

Link:

https://tip.neiki.dev/file/10cc9b5c656363346600d1381d88fb8010ea3d04007d82de8bbde06c8786eace

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cdgjwxdfmnrtizqa2e4b3ch3qaioupieab6yfxulxxqgzb4g5lha._file

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery spyware stealer

Link:

https://tria.ge/reports/260203-rv8f9aex4c/

Behaviour

Suspicious behavior: EnumeratesProcesses

Browser Information Discovery

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

10cc9b5c656363346600d1381d88fb8010ea3d04007d82de8bbde06c8786eace

MD5 hash:

d40756e973f6eb0e94aec6844289be7d

SHA1 hash:

88757825cae400b38859489f08853fd6a0828086

Link:

https://www.unpac.me/results/b0ab90f1-64db-44bb-8ca8-af3517ad21ed/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/10cc9b5c6563/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.33

Link:

https://yomi.yoroi.company/submissions/10cc9b5c656363346600d1381d88fb8010ea3d04007d82de8bbde06c8786eace

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.