MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c12a25439c8c3d66307a1629cf67320cfaa5e018ef09d9e6949f6949adae6571. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


UACModuleSmokeLoader


Vendor detections: 11


Intelligence 11 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c12a25439c8c3d66307a1629cf67320cfaa5e018ef09d9e6949f6949adae6571
SHA3-384 hash: 53b411d1f3cbf9f412d6dad95568b447664bed99790ea793340a96860bdfea827dd354aea96909c32b66af57c3233556
SHA1 hash: 9b5eeacf7c84c7cef44f436fb05135b7ac20520c
MD5 hash: 37845d07d093d70f454ac8e2b685bee7
humanhash: single-twenty-low-eighteen
File name:file
Download: download sample
Signature UACModuleSmokeLoader
Create hunting rule
File size:954'880 bytes
First seen:2024-05-08 16:47:01 UTC
Last seen:2024-05-08 17:40:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1dada0b4cf4997de4623b730c6639b58 (4 x UACModuleSmokeLoader)
ssdeep 12288:MOQNMIt3+hioijxOcaGW/v7EOEfvnJUC2+6zI4cHkYaG6U5SqFS4609bCFrZd:LWMIMhiop+4wjfvT2dMINbU5zFQmUz
TLSH T15915D0F5F6F09C37C172213DAC1AA23C69B6BD00AD245C0667EA6E4C9F357C135A8297
TrID 68.7% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58)
27.1% (.EXE) Win32 Executable Borland Delphi 6 (262638/61)
1.4% (.EXE) Win32 Executable Delphi generic (14182/79/4)
1.3% (.SCR) Windows screen saver (13097/50/3)
0.4% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):PE icon
dhash icon 00414f4f4f4f4700 (14 x CoinMiner, 12 x RedLineStealer, 12 x NodeLoader)
Reporter Bitsight
Tags:exe UACModuleSmokeLoader


Avatar
Bitsight
url: http://94.232.45.38/eee01.exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
328
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
c12a25439c8c3d66307a1629cf67320cfaa5e018ef09d9e6949f6949adae6571.exe
Verdict:
Malicious activity
Analysis date:
2024-05-08 16:49:20 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e3ee08e0-7eec-48a2-9b82-2192bf4e4a2b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Adware.Generic4.AANW.UNOFFICIAL
Create hunting rule

PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

PUA.Win.Packer.BorlandDelphi-1
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Rewriting of the hard drive's master boot record
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/c12a25439c8c3d66307a1629cf67320cfaa5e018ef09d9e6949f6949adae6571
Malware family:
Pitou
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0824dc30-a622-4b9a-ba19-ba2629dc5f73
Result
Threat name:
CryptOne
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1438455
Signature
Contains functionality to infect the boot sector
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected CryptOne packer
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c12a25439c8c3d66307a1629cf67320cfaa5e018ef09d9e6949f6949adae6571
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c12a25439c8c3d66307a1629cf67320cfaa5e018ef09d9e6949f6949adae6571/
Threat name:
Win32.Rootkit.BootkitX
Create hunting rule
Status:
Malicious
First seen:
2024-05-08 16:48:04 UTC
File Type:
PE (Exe)
Extracted files:
51
AV detection:
17 of 24 (70.83%)
Threat level:
  4/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yevckq44rq6wmmd2cyu46zzsbt5klyay54e5tzuut5uutlnomvyq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  6/10
Tags:
bootkit persistence
Link:
https://tria.ge/reports/240508-vajtyagd97/
Behaviour
Program crash
Writes to the Master Boot Record (MBR)
Unpacked files
SH256 hash:
609ef2b560381e8385a71a4a961afc94a1e1d19352414a591cd05217e9314625
MD5 hash:
1fc71d8e8cb831924bdc7f36a9df1741
SHA1 hash:
8b1023a5314ad55d221e10fe13c3d2ec93506a6c
Link:
https://www.unpac.me/results/bd27c703-5814-4825-b093-f702b792f172/
SH256 hash:
c12a25439c8c3d66307a1629cf67320cfaa5e018ef09d9e6949f6949adae6571
MD5 hash:
37845d07d093d70f454ac8e2b685bee7
SHA1 hash:
9b5eeacf7c84c7cef44f436fb05135b7ac20520c
Link:
https://www.unpac.me/results/bd27c703-5814-4825-b093-f702b792f172/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c12a25439c8c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
Link:
https://yomi.yoroi.company/submissions/c12a25439c8c3d66307a1629cf67320cfaa5e018ef09d9e6949f6949adae6571

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BobSoftMiniDelphiBoBBobSoft
Create hunting rule
Author:malware-lu
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:ICMLuaUtil_UACMe_M41
Create hunting rule
Author:Marius 'f0wL' Genheimer <hello@dissectingmalwa.re>
Description:A Yara rule for UACMe Method 41 -> ICMLuaUtil Elevated COM interface
Reference:https://github.com/hfiref0x/UACME
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Windows_Generic_Threat_5fbf5680
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

UACModuleSmokeLoader

Executable exe c12a25439c8c3d66307a1629cf67320cfaa5e018ef09d9e6949f6949adae6571

(this sample)

  
Dropped by
Privateloader
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2843412/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
SHELL_APIManipulates System Shellshell32.dll::ShellExecuteExW
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExA
kernel32.dll::LoadLibraryA
kernel32.dll::GetSystemInfo
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileA
kernel32.dll::FindFirstFileA
version.dll::GetFileVersionInfoSizeA
version.dll::GetFileVersionInfoA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::FindWindowA
user32.dll::PeekMessageA
user32.dll::CreateWindowExA

Comments