MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a38b5794002aad5eec54ca8e7d2a1171aea5f3e498a80780ec0a555b68c81199. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SmartLoader


Vendor detections: 9


Intelligence 9 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a38b5794002aad5eec54ca8e7d2a1171aea5f3e498a80780ec0a555b68c81199
SHA3-384 hash: f2d4e8e7fa7dad891ca0071cbdd082040acb50008bdb0bad77794d7d60ceeb8b543813edaa3e20c330ca2b9b14b402cf
SHA1 hash: 54a2f2387f82d7d9ad9a7b06727f6ac00e6476b8
MD5 hash: 3f99828a01afe43394b5bb7d39f6ef69
humanhash: delta-snake-papa-saturn
File name:Software.zip
Download: download sample
Signature SmartLoader
Create hunting rule
File size:549'072 bytes
First seen:2025-02-27 14:42:28 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:+mdAT9Eud6XYJH0ELzcYY33Ujy9VxO31XL+:+mdQ9E9XzELzcFUe9OY
TLSH T1A3C423B9DFF990B1C674DBF4E0D92AD29AD1A40AE4D470EF55689CD3FA16E002087782
Magika zip
Reporter tcains1
Tags:SmartLoader zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
US US
File Archive Information

This file archive contains 3 file(s), sorted by their relevance:

File name:Application.bat
File size:359 bytes
SHA256 hash: 706b47653ceee151d0c099bdab3959e7521b95c8b53830f9ce90e1797999a279
MD5 hash: b2eff1b64a08ea72550db2dffcb27e62
MIME type:text/plain
Signature SmartLoader
File name:asset.txt
File size:306'113 bytes
SHA256 hash: 884f1552fe526d72f01035f8fd1b565d254b52fbbfcb6cb034f34598794f7d7d
MD5 hash: 00ba06448d5e03dfbfa60a4bc2219193
MIME type:text/plain
Signature SmartLoader
File name:lua.exe
File size:881'152 bytes
SHA256 hash: da65a11facdbcbbc4949c3f0df30e45f139bed00a7d3d10fbdbb186c38c0bb63
MD5 hash: 6637d1fd08c7cd2a9ee25de2c9032150
MIME type:application/x-dosexec
Signature SmartLoader
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.74847598.24093.28639.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Win64.MalwareX-gen.12420.29010.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67c07a1d2dfba428b46ed0b9
Tags:
virus
Result
Verdict:
Suspicious
File Type:
PE File
Link:
https://app.docguard.net/a38b5794002aad5eec54ca8e7d2a1171aea5f3e498a80780ec0a555b68c81199/results/dashboard
Behaviour
BlacklistAPI detected
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
fingerprint microsoft_visual_cc obfuscated
Link:
https://www.filescan.io/uploads/67c07a023c5f644bd93af0ca/reports/0a6903a0-c742-4a16-86c5-2c30c98fc582/overview
Verdict:
Suspicious
Labled as:
Trojan.Win64.AI.oa
Link:
https://www.hybrid-analysis.com/sample/a38b5794002aad5eec54ca8e7d2a1171aea5f3e498a80780ec0a555b68c81199
Score:
84%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/a38b5794002aad5eec54ca8e7d2a1171aea5f3e498a80780ec0a555b68c81199
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a38b5794002aad5eec54ca8e7d2a1171aea5f3e498a80780ec0a555b68c81199/
Threat name:
Win32.Trojan.Alevaul
Create hunting rule
Status:
Malicious
First seen:
2024-11-09 02:38:08 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uofvpfaafkwv53cuzkhh2kqrogxkl47etcuapahmbjkvw2gicgmq._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/250227-sknvjazzgw/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Drops file in Windows directory
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a38b5794002aad5eec54ca8e7d2a1171aea5f3e498a80780ec0a555b68c81199

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Suspicious_Latam_MSI_and_ZIP_Files
Create hunting rule
Author:eremit4, P4nd3m1cb0y
Description:Detects suspicious .msi and .zip files used in Latam banking trojan campaigns.
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SmartLoader

zip a38b5794002aad5eec54ca8e7d2a1171aea5f3e498a80780ec0a555b68c81199

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3459820/

Comments