MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f77fd23a994d6cbb4a11428bf2909f8367a4c72d359c85e8d3e37957346ddef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


UACModuleSmokeLoader


Vendor detections: 15


Intelligence 15 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5f77fd23a994d6cbb4a11428bf2909f8367a4c72d359c85e8d3e37957346ddef
SHA3-384 hash: a578b056febbd82ad055714b67fdbc23c28f3153c98ff3cd4cda5a6ed5af2c2a34b7f93f1230434c594b0c920d063e99
SHA1 hash: b55b347c1f7fcaa32260ae38f6f231d48d18bc32
MD5 hash: 7ed3a737e327cf7f0260c1b2d41a17b5
humanhash: summer-foxtrot-jupiter-black
File name:SecuriteInfo.com.Win32.BootkitX-gen.3175.18421
Download: download sample
Signature UACModuleSmokeLoader
Create hunting rule
File size:2'122'752 bytes
First seen:2025-02-11 14:09:15 UTC
Last seen:2025-02-11 14:49:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep 49152:xLoHkktr7eRXtkhSBTiNpEdtHUIvzbWJhnB1Kp99:x0Ezkhpa0UzK
Threatray 1 similar samples on MalwareBazaar
TLSH T17BA5333251266027C1DE82B8D10E5238DAA426D094ABFAF5DCE5B92DEDCF7E067DF404
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.6% (.EXE) Win32 Executable (generic) (4504/4/1)
8.5% (.ICL) Windows Icons Library (generic) (2059/9)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter SecuriteInfoCom
Tags:exe UACModuleSmokeLoader

Intelligence

File Origin
# of uploads :
2
# of downloads :
442
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.Win32.BootkitX-gen.3175.18421
Verdict:
Malicious activity
Analysis date:
2025-02-11 14:11:33 UTC
Tags:
themida
Link:
https://app.any.run/tasks/49bc941f-68a7-455a-88a2-432ec5405324

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.BootkitX-gen.3175.18421.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
96.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67ab5a5b49f32dfb0d830266
Tags:
vmdetect spoof
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Searching for analyzing tools
Rewriting of the hard drive's master boot record
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm obfuscated packed packed packer_detected
Link:
https://www.filescan.io/uploads/67ab5a77015cc15e3a5a0360/reports/c6fb549c-964c-48a3-8f5b-0cebd5e77b43/overview
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/5f77fd23a994d6cbb4a11428bf2909f8367a4c72d359c85e8d3e37957346ddef
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/c27a797a-48cd-4cb6-aadb-a5300de9687e
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1612121
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to infect the boot sector
Detected unpacking (changes PE section rights)
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
PE file contains section with special chars
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5f77fd23a994d6cbb4a11428bf2909f8367a4c72d359c85e8d3e37957346ddef
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5f77fd23a994d6cbb4a11428bf2909f8367a4c72d359c85e8d3e37957346ddef/
Threat name:
Win32.Trojan.Amadey
Create hunting rule
Status:
Malicious
First seen:
2025-02-11 14:10:25 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l5372i5jstlmxnfbcqul6kij7a3hutds2nm4qxunhy3zk42g3xxq._file
Verdict:
malicious
Label(s):
pitou
Create hunting rule
Similar samples:
5f77fd23a994d6cbb4a11428bf2909f8367a4c72d359c85e8d3e37957346ddef
UACModuleSmokeLoader
error
UACModuleSmokeLoader
Result
Malware family:
n/a
Score:
  9/10
Tags:
bootkit defense_evasion discovery persistence
Link:
https://tria.ge/reports/250211-rgvy1avnfp/
Behaviour
Suspicious behavior: EnumeratesProcesses
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Writes to the Master Boot Record (MBR)
Checks BIOS information in registry
Identifies Wine through registry keys
Downloads MZ/PE file
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/70108839-ae77-4f81-b49b-1d1b3c27ffd8
Unpacked files
SH256 hash:
5f77fd23a994d6cbb4a11428bf2909f8367a4c72d359c85e8d3e37957346ddef
MD5 hash:
7ed3a737e327cf7f0260c1b2d41a17b5
SHA1 hash:
b55b347c1f7fcaa32260ae38f6f231d48d18bc32
Link:
https://www.unpac.me/results/b22e5615-612b-4c54-adea-e44ac81bec99/
SH256 hash:
40ee61bee3a4e0b8e3500b3032e8c4e76734a812082c32a6efdd847407d3ff72
MD5 hash:
9ef4b8bbb714c7c4b7fa57ae2ef846e5
SHA1 hash:
1c3b735379c427ca085bb8e417aa08bce3ffee86
Detections:
INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Link:
https://www.unpac.me/results/b22e5615-612b-4c54-adea-e44ac81bec99/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5f77fd23a994/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5f77fd23a994d6cbb4a11428bf2909f8367a4c72d359c85e8d3e37957346ddef

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ICMLuaUtil_UACMe_M41
Create hunting rule
Author:Marius 'f0wL' Genheimer <hello@dissectingmalwa.re>
Description:A Yara rule for UACMe Method 41 -> ICMLuaUtil Elevated COM interface
Reference:https://github.com/hfiref0x/UACME
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:smokeloader_uac_module
Create hunting rule
Author:Nikolaos 'n0t' Totosis
Description:UAC bypass/file dropped by Smokeloader
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:Windows_Generic_Threat_5fbf5680
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

UACModuleSmokeLoader

Executable exe 5f77fd23a994d6cbb4a11428bf2909f8367a4c72d359c85e8d3e37957346ddef

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3435913/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3434374/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical

Comments