MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 16


Intelligence 16 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8
SHA3-384 hash: 73fe54194638c2cfe247d548ceb036a81173f9589ce7b8da36f5f43408f0f18172859a625d0ec0e1c06dcc183a3bc92e
SHA1 hash: a08c39ed82828542d6989c0687f42171c9200b63
MD5 hash: c39f757fded242b3c69cb742e5b8adfb
humanhash: ceiling-aspen-foxtrot-north
File name:file
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:9'216 bytes
First seen:2026-03-07 20:48:48 UTC
Last seen:2026-03-12 19:39:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0b2f31160a5382dbf07d030ba66e1330 (1 x Smoke Loader, 1 x Phorpiex)
ssdeep 96:kDb5RgtomuBk+Bd1sOD1kMZ+t8pwkMPFJxGE9mK2FFhSC7tCEanGh:YHgDuBkwZ+mePFJxT4KmFhvak
Threatray 134 similar samples on MalwareBazaar
TLSH T13E12190F7E498172D3940DF013B64B8D8A7D54A33792A2FBF773C5590F65240E492AEA
TrID 39.7% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
21.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
8.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
8.3% (.EXE) Win64 Executable (generic) (6522/11/2)
6.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
Reporter Bitsight
Tags:dropped-by-phorpiex exe Smoke Loader


Avatar
Bitsight
url: http://178.16.54.109/newtpp.exe

Intelligence

File Origin
# of uploads :
465
# of downloads :
200
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
phorpiex
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2026-03-07 20:49:46 UTC
Tags:
loader auto-reg botnet phorpiex stealer
Link:
https://app.any.run/tasks/ba63a21a-a496-437f-83a2-10a6cbee36ca

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/56583/
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.68691153.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69ac8f54e41a5a099930a8d2
Tags:
phorpiex spam
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm microsoft_visual_cc
Link:
https://www.filescan.io/uploads/69ac8f4a97feb4afd67335c7/reports/34be53b9-8b7c-47f2-b92f-cbbd3e2fe484/overview
Verdict:
Malicious
Labled as:
Fragtor.Generic
Link:
https://www.hybrid-analysis.com/sample/d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8
Verdict:
Malicious
File Type:
exe x32
Detections:
Trojan.Win32.Zonidel.sb Trojan-Dropper.Win32.Dorifel.sbc HEUR:Virus.Win32.Zeropi.gen HEUR:Trojan-Banker.Win32.Phorpiex.gen Trojan.Agentb.UDP.C&C PDM:Trojan.Win32.Generic Backdoor.Agent.HTTP.C&C Trojan-Banker.Win32.ClipBanker.sb Backdoor.Win32.Agent.myxdzn HEUR:Worm.Win32.Generic HEUR:Trojan.Win32.Agent.gen Trojan-PSW.PureLogs.TCP.C&C Trojan.Win32.Agent.sb HEUR:Trojan-Downloader.Win32.Agent.gen RiskTool.BitCoinMiner.TCP.C&C
Link:
https://opentip.kaspersky.com/d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/c934c8ac-18ac-458a-bac2-dd9008cb2cac
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/c39f757fded242b3c69cb742e5b8adfb
Detection:
phorpiex
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8/
Verdict:
Malicious
Threat:
Family.PHORPIEX
Link:
https://tip.neiki.dev/file/d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8
Threat name:
Win32.Worm.Phorpiex
Create hunting rule
Status:
Suspicious
First seen:
2026-03-07 20:49:22 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
18 of 36 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3ghni62scvo4niky7fqnyimecu6yj2einwni732dtrz7mnjrhd4a._file
Verdict:
malicious
Label(s):
phorpiex
Create hunting rule
Similar samples:
02816012e5b60a4dd35390137f9bceb33752abd5a4cd5ec5794bdd3ffb7899c5
Smoke Loader
5ee7c0fb726d43c3fec9c254a88240d9a032b2451ef39acb28a7f5aec36d86c9
Smoke Loader
98e5fdce85ab8e17472f95eecb4c22f08a28933828e0afd0b5db831fe222e373
Smoke Loader
e3513922666c202c1ae5c06eea277ba10477868d6d89ce2819f4f8ff9070bc85
Smoke Loader
error
Smoke Loader
+ 124 additional samples on MalwareBazaar
Result
Malware family:
phorphiex
Create hunting rule
Score:
  10/10
Tags:
family:phorphiex discovery loader persistence spyware stealer trojan worm
Link:
https://tria.ge/reports/260307-zl4eyagw7t/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Browser Information Discovery
System Location Discovery: System Language Discovery
Drops file in Windows directory
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Executes dropped EXE
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Downloads MZ/PE file
Phorphiex family
Phorphiex, Phorpiex
Malware Config
C2 Extraction:
178.16.54.109
Unpacked files
SH256 hash:
d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8
MD5 hash:
c39f757fded242b3c69cb742e5b8adfb
SHA1 hash:
a08c39ed82828542d6989c0687f42171c9200b63
Link:
https://www.unpac.me/results/e7b3fb96-1aa6-4290-9b42-8ae9ac903f44/
Malware family:
Phorpiex
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d98ed47b5215/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Phorpiex
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe d98ed47b52155dc6a158f960dc2184153d84e8886d9a8fef439c73f6353138f8

(this sample)

  
Dropped by
Phorpiex
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/56583/
  
URLhaus
https://urlhaus.abuse.ch/url/3688690/

Comments