MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6ffb2c4094ba1b04552c70fb49a92666beecc063ac1b2ed23dda77d426a5dc2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

UACModuleSmokeLoader

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	d6ffb2c4094ba1b04552c70fb49a92666beecc063ac1b2ed23dda77d426a5dc2
SHA3-384 hash:	96ec679db4f9ce795c87f990914bc05c2f579388bb42da6fb8fecbca76be85d0d0eb4ddc4af4b1f13ba16387bd9a3a07
SHA1 hash:	18e008fcfa7707a379624f9edec00b96c43e3537
MD5 hash:	8eaa011010a7c06112c785299400d574
humanhash:	aspen-angel-venus-moon
File name:	8eaa011010a7c06112c785299400d574.exe
Download:	download sample
Signature	UACModuleSmokeLoader Create hunting rule
File size:	593'408 bytes
First seen:	2023-08-04 04:52:09 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	242d7fcf794500079c92bb6f2a532781 (1 x UACModuleSmokeLoader)
ssdeep	12288:i9PQhLdBT28h3eqCmzKJ5NOhXZOHaQCs:0IdrTR3eqJONeX4HaFs
Threatray	48 similar samples on MalwareBazaar
TLSH	T15AC4027266B2C872E53602318D1AD7F86A3FB4718D55DB573384CA2F1A723A3DA23701
TrID	37.3% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 16.0% (.EXE) Win32 Executable (generic) (4505/5/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	0000290140343019 (1 x UACModuleSmokeLoader)
Reporter	abuse_ch
Tags:	exe UACModuleSmokeLoader

Intelligence

File Origin

# of uploads :

# of downloads :

297

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

8eaa011010a7c06112c785299400d574.exe

Verdict:

Malicious activity

Analysis date:

2023-08-04 04:57:20 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/3f768246-0616-49c9-8cbd-676939afdca9

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/440239/

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a custom TCP request

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/64cc842d8b880a9fc643bbe8/reports/c89c54b5-939f-4935-ba75-55e77802447a/overview

Verdict:

Malicious

Labled as:

Pack.Emotet.Generic

Link:

https://www.hybrid-analysis.com/sample/d6ffb2c4094ba1b04552c70fb49a92666beecc063ac1b2ed23dda77d426a5dc2

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Pitou

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c2ca27bf-83c0-4d69-95ed-971e199289e1

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/1285546

Signature

Contains functionality to infect the boot sector

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d6ffb2c4094ba1b04552c70fb49a92666beecc063ac1b2ed23dda77d426a5dc2/

Threat name:

Win32.Ransomware.StopCrypt

Status:

Malicious

First seen:

2023-08-03 21:34:29 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2373frajjoq3arksy4h3jgusmzv65taghla3f3jd3wtx2qtklxba._file

Verdict:

malicious

UACModuleSmokeLoader

0c8fcb4201e67579906b7a3512f0f093297231ecad2b949a7b41d377f22b5d56

UACModuleSmokeLoader

17745cf313048c8618b348f3ed48abf6dc440e956a33ffdb252e53d6c05062a4

UACModuleSmokeLoader

375f623741fe071117c32d8e027f9a705ab54586b12ee5504a56d2205e95b38c

UACModuleSmokeLoader

46a218a16190914c66dbcdf1a8c0d35aa3d0bc246b6cf16075567c85340bd33f

UACModuleSmokeLoader

975ebd15c72754378f2a55d809a321666db1b68a69e6fbfb6ae19813f7809ca9

UACModuleSmokeLoader

c98b767c0ceb5c2bc05e873a06f0f264d8f7e42fd51c475e8595514d8b81f09f

UACModuleSmokeLoader

d68839827fc159c514d91b76e31f3ec0f665a1e577433c11955acb5b4fce2057

UACModuleSmokeLoader

e7910bc87f0092c72a683ae1bb28ed7ba91077bdfe38dc82376f154b2ccf022d

UACModuleSmokeLoader

+ 38 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

6/10

Tags:

bootkit persistence

Link:

https://tria.ge/reports/230804-fhy69saf8x/

Behaviour

Writes to the Master Boot Record (MBR)

Unpacked files

SH256 hash:

87f776743f1852705d418c3627744380019e9d63dd70737962f56bd2f1ff107a

MD5 hash:

beb1f632da458d8cdd00103654be92c9

SHA1 hash:

3cd539f2cb3a2f2cfbc1943a32432bfbc7f81b96

Link:

https://www.unpac.me/results/d040e249-36eb-446f-b888-4562f8ef77af/

SH256 hash:

d6ffb2c4094ba1b04552c70fb49a92666beecc063ac1b2ed23dda77d426a5dc2

MD5 hash:

8eaa011010a7c06112c785299400d574

SHA1 hash:

18e008fcfa7707a379624f9edec00b96c43e3537

Link:

https://www.unpac.me/results/d040e249-36eb-446f-b888-4562f8ef77af/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d6ffb2c4094b/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d6ffb2c4094ba1b04552c70fb49a92666beecc063ac1b2ed23dda77d426a5dc2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.