MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 86c6ae7c4fd825bf4bf58401e895acbef5ba52380bcb55c5149ba231c57eb03d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 86c6ae7c4fd825bf4bf58401e895acbef5ba52380bcb55c5149ba231c57eb03d
SHA3-384 hash: 43de0521bbdade38bcb374a6241caf7f765d165b016658e2c90c57584feb36fc9f186675665cd9f11974831814e9e242
SHA1 hash: cd8bff9f9492a6c114af35708b0f1c0372b91656
MD5 hash: e570255a304227095bd635a92f9720ba
humanhash: november-glucose-lake-colorado
File name:Qtum.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:2'711'000 bytes
First seen:2026-03-07 14:10:22 UTC
Last seen:2026-03-07 14:50:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 49152:VljSvNCIk3PJSH6jypriqNP0WyvDtLH0/cvDhNlulRYQTeKADxJryXEQ9V1dIjnd:QNuxSH6u5iwOR0/ihNwlTT3KqXr3w
TLSH T1AAC501322FDE5132E4AD73B4D5E17A05AE787D90E5944AF9E4A862C90C758003E3ED3B
TrID 33.1% (.EXE) Win64 Executable (generic) (6522/11/2)
25.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.4% (.ICL) Windows Icons Library (generic) (2059/9)
10.3% (.EXE) OS/2 Executable (generic) (2029/13)
10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter aachum
Tags:acecareer-edu baxe-pics coox-live exe signed Smoke Loader

Code Signing Certificate

Organisation:Zieme and Sons
Issuer:Zieme and Sons
Algorithm:sha256WithRSAEncryption
Valid from:2026-03-04T18:45:36Z
Valid to:2028-03-05T18:45:36Z
Serial number: b44814a98454ad0a
Thumbprint Algorithm:SHA256
Thumbprint: 5d64a9921a5c8ab8ccc98c1855c7b80843d208d1882d7a5c9fcae03030d6ae1f
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
iamaachum
https://acecareer.edu/wp-includes/certificates/Qtum.exe

SmokeLoader IOCs:
103.211.219.238:4219
65.21.104.235:48261
168.231.114.49:28313
62.72.32.156:5902
http://zadno.run:4219/
http://baxe.pics:48261/
coox.live
chalx.live

Intelligence

File Origin
# of uploads :
2
# of downloads :
144
Origin country :
ES ES
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
_aaf0109974d4570b530a19c85f2bd0eb15b7ba824bde98fc5ef453b40b81788c.txt
Verdict:
Malicious activity
Analysis date:
2026-03-07 14:09:05 UTC
Tags:
stealer
Link:
https://app.any.run/tasks/7443f954-05fa-4cca-899b-909021ae1206

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/56551/
Detection(s):
SecuriteInfo.com.Variant.Lazy.710494.28447.23065.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69ac31d7e5dc8e2b2c308175
Tags:
n/a
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
installer-heuristic packed signed
Link:
https://www.filescan.io/uploads/69ac3201cd25bfe1dfe393d0/reports/315f9dc5-ce55-46d3-81c2-20a43f2bac11/overview
Verdict:
Malicious
Labled as:
Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/86c6ae7c4fd825bf4bf58401e895acbef5ba52380bcb55c5149ba231c57eb03d
Verdict:
Malicious
File Type:
exe x64
Detections:
PDM:Trojan.Win32.Generic Trojan.Win32.Injuke.pmkb
Link:
https://opentip.kaspersky.com/86c6ae7c4fd825bf4bf58401e895acbef5ba52380bcb55c5149ba231c57eb03d/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/7f204b1f-bf65-4579-ac37-63d727078371
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj.spyw.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1880017
Signature
AI detected suspicious PE digital signature
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Tries to steal from password manager
Tries to steal Mail credentials (via file / registry access)
Unusual module load detection (module proxying)
Uses known network protocols on non-standard ports
Behaviour
Behavior Graph:
Download SVG
Score:
55%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/86c6ae7c4fd825bf4bf58401e895acbef5ba52380bcb55c5149ba231c57eb03d
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/e570255a304227095bd635a92f9720ba
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/86c6ae7c4fd825bf4bf58401e895acbef5ba52380bcb55c5149ba231c57eb03d/
Verdict:
Malicious
Threat:
Trojan.Win32
Link:
https://tip.neiki.dev/file/86c6ae7c4fd825bf4bf58401e895acbef5ba52380bcb55c5149ba231c57eb03d
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-03-07 14:11:16 UTC
File Type:
PE+ (Exe)
Extracted files:
19
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=q3dk47cp3as36s7vqqa6rfnmx323uurybpfvlriutorddrl6wa6q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery spyware stealer
Link:
https://tria.ge/reports/260307-rhcttact6p/
Behaviour
Suspicious behavior: EnumeratesProcesses
Browser Information Discovery
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
86c6ae7c4fd825bf4bf58401e895acbef5ba52380bcb55c5149ba231c57eb03d
MD5 hash:
e570255a304227095bd635a92f9720ba
SHA1 hash:
cd8bff9f9492a6c114af35708b0f1c0372b91656
Link:
https://www.unpac.me/results/92f4c892-563d-413d-9e59-14c8810c2ecc/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/86c6ae7c4fd8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Smokeloader
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/86c6ae7c4fd825bf4bf58401e895acbef5ba52380bcb55c5149ba231c57eb03d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:test_Malaysia
Create hunting rule
Author:rectifyq
Description:Detects file containing malaysia string

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 86c6ae7c4fd825bf4bf58401e895acbef5ba52380bcb55c5149ba231c57eb03d

(this sample)

  
Link
https://tria.ge/260307-raryrsew8w/behavioral2
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/56551/
  
URLhaus
https://urlhaus.abuse.ch/url/3791561/

Comments