MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 683391c9e997f8e960c52edb11106157fb4bf122d21a0a72fe6a9a14ebacf584. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


UACModuleSmokeLoader


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 683391c9e997f8e960c52edb11106157fb4bf122d21a0a72fe6a9a14ebacf584
SHA3-384 hash: c834e5015b2d18144175a823b99b7a011f130dbfd2b8c15982a3e6fa5c732a9745d1d5b902a55c3b46f3c520bb4c5639
SHA1 hash: 0a96781c3e937cd7c12a052242f4755ea3656297
MD5 hash: 59f2f7f0cf8faf41dbb0a7878b5d66bb
humanhash: juliet-island-stairway-connecticut
File name:file
Download: download sample
Signature UACModuleSmokeLoader
Create hunting rule
File size:431'104 bytes
First seen:2024-01-10 21:11:33 UTC
Last seen:2024-09-21 21:41:33 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 32a31bfad8ca2c4b8a1a523b9cceb9d8 (7 x UACModuleSmokeLoader)
ssdeep 12288:MSasngwHpPE9JyzE7Q1Hlt/a7CLfznto3ZUsVB:gsngwHpPvgqFRaGLfDtMZUOB
Threatray 140 similar samples on MalwareBazaar
TLSH T1C2940212B301637BC1F3A5F2279B90EFE3109539132185D739DC06756B868A8BB3A7D6
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter andretavare5
Tags:exe UACModuleSmokeLoader


Avatar
andretavare5
Sample downloaded from https://vk.com/doc418490229_670598248?hash=1w1aaquN7KDwe4Kn0zzo0AbZyh5hDavoqYWwuEKs0Qk&dl=5BuhwESzDVtzEkqTPzAl264aZTOtWmoXZL0iDrQqvez&api=1&no_preview=1#zero

Intelligence

File Origin
# of uploads :
4
# of downloads :
493
Origin country :
US US
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/470255/
Detection(s):
SecuriteInfo.com.Trojan.Pitou.17.20725.18014.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Sending a custom TCP request
Rewriting of the hard drive's master boot record
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
lolbin packed shell32
Link:
https://www.filescan.io/uploads/659f082494d1aebfb2988f0f/reports/9672beb3-5031-409c-a176-4b1a887d89a4/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/683391c9e997f8e960c52edb11106157fb4bf122d21a0a72fe6a9a14ebacf584
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Pitou
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/588e7ae9-f070-4e25-880c-d7b5849e20cb
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1372681
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to infect the boot sector
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/683391c9e997f8e960c52edb11106157fb4bf122d21a0a72fe6a9a14ebacf584
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/683391c9e997f8e960c52edb11106157fb4bf122d21a0a72fe6a9a14ebacf584/
Threat name:
Win32.Trojan.Pitou
Create hunting rule
Status:
Malicious
First seen:
2024-01-10 21:12:05 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
23 of 24 (95.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nazzdspjs74osygff3nrcedbk75ux4jc2inau4x6nknbj25m6wca._file
Verdict:
malicious
Similar samples:
0c8fcb4201e67579906b7a3512f0f093297231ecad2b949a7b41d377f22b5d56
UACModuleSmokeLoader
1d231194ad5d77102a9f38140fbec3a519fb3db1158f3a02fb49372bfc68df30
UACModuleSmokeLoader
4500f0d2feadf7c3f582442aad4d48bdd61c5e915827b0212d528d720fe2cc6e
UACModuleSmokeLoader
6c3faa9c54a7d44226623afee69d63114957699330dd576092965999550dd19d
UACModuleSmokeLoader
844538a01b9dade63ab97b500427ab7b4ce3507cc462953cd81d263edc3aac8b
UACModuleSmokeLoader
c98b767c0ceb5c2bc05e873a06f0f264d8f7e42fd51c475e8595514d8b81f09f
UACModuleSmokeLoader
d2a5bffc667647e9ba8a0d1733f9a27df01af72b9dbc7193031aad4c8853c6e4
UACModuleSmokeLoader
d6a38a2e5ae630ab2d30f879433bb3f0268d65861a2f49703319d1469a1e4b39
UACModuleSmokeLoader
e7910bc87f0092c72a683ae1bb28ed7ba91077bdfe38dc82376f154b2ccf022d
UACModuleSmokeLoader
f3cc24a419c6822084fbd496d4d169b61d7ca28b31fc6d1032d6255179521a68
UACModuleSmokeLoader
+ 130 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
bootkit persistence
Link:
https://tria.ge/reports/240110-z1573shcd3/
Behaviour
Writes to the Master Boot Record (MBR)
Unpacked files
SH256 hash:
683391c9e997f8e960c52edb11106157fb4bf122d21a0a72fe6a9a14ebacf584
MD5 hash:
59f2f7f0cf8faf41dbb0a7878b5d66bb
SHA1 hash:
0a96781c3e937cd7c12a052242f4755ea3656297
Link:
https://www.unpac.me/results/08d2313c-33c8-497c-b801-1a669b500bc1/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/683391c9e997/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/683391c9e997f8e960c52edb11106157fb4bf122d21a0a72fe6a9a14ebacf584

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:win_pitou_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.pitou.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
Cape
Cape
https://www.capesandbox.com/analysis/470255/

Comments