MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9af93724ab81fd0e84618d4deee00cbff9d0aaee4ec642ee0429790826487049. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9af93724ab81fd0e84618d4deee00cbff9d0aaee4ec642ee0429790826487049
SHA3-384 hash: 451e9695fa3e01cfd4e9eeb22a23dcaf26220f19e79bc53d40338c070b85456bde09ad11899e1c8bfff3bbea7a25dba1
SHA1 hash: bea85db200ffd9b894efa06d5dc2966134bd8625
MD5 hash: 804b7ae1fb088069f5ebc3471ba64fac
humanhash: oven-neptune-floor-asparagus
File name:Inv_868470_991200.zip
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:60'990 bytes
First seen:2020-11-23 18:35:13 UTC
Last seen:2020-11-23 19:14:45 UTC
File type: zip
MIME type:application/zip
ssdeep 768:7QOmRxoEXY8h2bVGQqM4wXZbEoE7Cot4X/nhzCVneJ4Ta6BS8sW7IXb8NOMvTnOI:7QTbHoT0JM/BEZ7C/Y+4TarFWUXbRLML
TLSH 7553028B6CE97C38C8B9AB32CC346A173886B5A0DFEC3005D85DD4912F90A58DE9D587
Reporter cocaman
Tags:zip


Avatar
cocaman
Malicious email (T1566.001)
From: "<ourhbn@pasadenawebcam.com>" (likely spoofed)
Received: "from 78-83-98-20.spectrumnet.bg (78-83-98-20.spectrumnet.bg [78.83.98.20]) "
Date: "Mon, 23 Nov 2020 21:12:21 +0200"
Subject: "Your invoice # 817796 is attached."
Attachment: "Invoice_817796_065801.zip"

Intelligence

File Origin
# of uploads :
5
# of downloads :
200
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9af93724ab81fd0e84618d4deee00cbff9d0aaee4ec642ee0429790826487049/
Threat name:
Win32.Trojan.Smokeloader
Create hunting rule
Status:
Malicious
First seen:
2020-11-23 18:36:05 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tl4tojflqh6q5bdbrvg65yamx745bkxoj3def3qeff4qqjsiobeq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9af93724ab81fd0e84618d4deee00cbff9d0aaee4ec642ee0429790826487049

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Smoke Loader

zip 9af93724ab81fd0e84618d4deee00cbff9d0aaee4ec642ee0429790826487049

(this sample)

Smoke Loader

Executable exe 7af038d2f4f41c0d130aaa1e4557d821e2b7f4c6bda2be44300e229cd5c721df

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7af038d2f4f41c0d130aaa1e4557d821e2b7f4c6bda2be44300e229cd5c721df

Comments