🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a9a534fd91efe25fac592831a2565d33b3cc73dac9a68a318ce079452b4ceeb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SmartLoader


Vendor detections: 6


Intelligence 6 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9a9a534fd91efe25fac592831a2565d33b3cc73dac9a68a318ce079452b4ceeb
SHA3-384 hash: 89d18540342248940f637367359a059261210bd328299d7998247c06ef58b8376c3929f4d6b7105f62a6a2bfa4bc9e27
SHA1 hash: 4f3fbe9a1c37aa0ee7ed4d4a2feb4e1af7dffa81
MD5 hash: 3aab4c9294c7abe63bb278102938ba7e
humanhash: ack-oregon-ack-massachusetts
File name:Software(4).zip
Download: download sample
Signature SmartLoader
Create hunting rule
File size:357'962 bytes
First seen:2025-03-24 09:17:07 UTC
Last seen:2025-03-24 09:17:29 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:euUPsgJV8ZHLO2Y1RZbDGFIPMKseQnJ16DXbfEnmZ3J51ewxGyWPfg7lCfYasoP0:D+38ZpY1PDGmPWerrEnm1x5mvQu0
TLSH T1447423135C7F1B06CA4439729DFE6CD84392BB88E63E670A660877DB101E54A3E1F6A4
Magika zip
Reporter JAMESWT_WT
Tags:SmartLoader zip

Intelligence

File Origin
# of uploads :
2
# of downloads :
26
Origin country :
IT IT
File Archive Information

This file archive contains 5 file(s), sorted by their relevance:

File name:Launch.bat
File size:49 bytes
SHA256 hash: 9c5c562b5f7c10882141a505728a6d9fe36ccd5c4fef5099a74f11bcb7f71284
MD5 hash: 144f19dcd29f6bef334db29b75c4586a
MIME type:text/plain
Signature SmartLoader
File name:COFF_SYMBOLS
File size:4'156 bytes
SHA256 hash: 623d29ab316b74cfb7dba581e2e2c49ea63fb39e05e1823d30b92a6a5d5ae13b
MD5 hash: 516d16c6816d5bcd52e0d6d34ea7ed23
MIME type:application/octet-stream
Signature SmartLoader
File name:lua51.dll
File size:422'972 bytes
SHA256 hash: 012e772e3c72c5f500aab86e78e99afff222bdc8d914bc32bb244ade03d5a486
MD5 hash: 2f0394640486f2ac8dfb23ee05f904a9
MIME type:application/x-dosexec
Signature SmartLoader
File name:userdata.txt
File size:240'231 bytes
SHA256 hash: 0ed8e43a9b0bbb8754ec1ce195e07f6af5e5363ab039cda32413746a3e772fa8
MD5 hash: 3900f59be2ef3852fac16940e172ee3f
MIME type:text/plain
Signature SmartLoader
File name:luajit.exe
File size:24'935 bytes
SHA256 hash: 30f7bd2e98df2ec3405f3ab4aab5be8f0dc1d9ac638286edf390c4ddb74b4316
MD5 hash: e1bae2b33bbcf7d1dad46f57fe537141
MIME type:application/x-dosexec
Signature SmartLoader
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.VBS.Obfus-141.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67e24739bb84e066269ebc52
Tags:
shell sage
Result
Verdict:
Unknown
File Type:
PE File
Link:
https://app.docguard.net/9a9a534fd91efe25fac592831a2565d33b3cc73dac9a68a318ce079452b4ceeb/results/dashboard
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
anti-debug mingw overlay
Link:
https://www.filescan.io/uploads/67e12350e245f7bec6d17e38/reports/38c0c40a-8cb2-4803-8466-0990ec5d2509/overview
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/9a9a534fd91efe25fac592831a2565d33b3cc73dac9a68a318ce079452b4ceeb
Score:
99%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/9a9a534fd91efe25fac592831a2565d33b3cc73dac9a68a318ce079452b4ceeb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9a9a534fd91efe25fac592831a2565d33b3cc73dac9a68a318ce079452b4ceeb/
Threat name:
Script-JS.Trojan.Smartloader
Create hunting rule
Status:
Malicious
First seen:
2025-02-01 23:19:35 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
15 of 24 (62.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tknfgt6zd37cl6wfskbrujlf2m5tzrz5vsngriyyzydziuvuz3vq._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
discovery execution
Link:
https://tria.ge/reports/250324-lasmeawsfs/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Drops file in Windows directory
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:Suspicious_Latam_MSI_and_ZIP_Files
Create hunting rule
Author:eremit4, P4nd3m1cb0y
Description:Detects suspicious .msi and .zip files used in Latam banking trojan campaigns.
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SmartLoader

zip 9a9a534fd91efe25fac592831a2565d33b3cc73dac9a68a318ce079452b4ceeb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3488632/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3488636/

Comments