🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dff1858beb573519c464988a2c93a5d5b50e8fc2fb123a1b1393cf1aa5c2ef2b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


SmartLoader


Vendor detections: 5


Intelligence 5 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dff1858beb573519c464988a2c93a5d5b50e8fc2fb123a1b1393cf1aa5c2ef2b
SHA3-384 hash: d28f396b4065e6ca1eba0af9d7a35fd55279f4ccae418303318895b56d71a8a41ba800d5495ab1f6a884a96f5bdecbb1
SHA1 hash: f6a648b2c8b097248f7d25af322b91607fc8fae2
MD5 hash: 630f428bf3c25dfca46e91edde334342
humanhash: pizza-louisiana-emma-winner
File name:Application.zip
Download: download sample
Signature SmartLoader
Create hunting rule
File size:926'154 bytes
First seen:2025-03-21 15:16:03 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:XBE/nJIRs2wv8s7/mj/73RaLHIW5BmUeUhoE4RgiF1q1bPIBKsg4Db0S4:XGRADwkc/u/7IoRnUKfq1Dl4DYt
TLSH T1E215AFC0F5C241F2E6E611718476DE36463E3D2187028CEB7798BAF55E305D0A637AAE
Magika zip
Reporter tcains1
Tags:SmartLoader zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
US US
File Archive Information

This file archive contains 4 file(s), sorted by their relevance:

File name:Launcher.bat
File size:2'664 bytes
SHA256 hash: 89a1cffdb1f1facdc871ee710cbb92a063d30afcafb36334214ab08f5c38f80a
MD5 hash: 92180d52ef35edd36a28f52052f90c5c
MIME type:text/plain
Signature SmartLoader
File name:lua.exe
File size:91'136 bytes
SHA256 hash: 1cf20b8449ea84c684822a5e8ab3672213072db8267061537d1ce4ec2c30c42a
MD5 hash: dd98a43cb27efd5bcc29efb23fdd6ca5
MIME type:application/x-dosexec
Signature SmartLoader
File name:lua51.dll
File size:606'208 bytes
SHA256 hash: ff976f6e965e3793e278fa9bf5e80b9b226a0b3932b9da764bffc8e41e6cdb60
MD5 hash: 3dff7448b43fcfb4dc65e0040b0ffb88
MIME type:application/x-dosexec
Signature SmartLoader
File name:config.txt
File size:225'600 bytes
SHA256 hash: d92b9e01e24935e1cc6144734c0b39379edef1e3c06aedbd547dc304e7334d77
MD5 hash: 96c673c9e9dedefec5fd5e27284e4f29
MIME type:text/plain
Signature SmartLoader
Vendor Threat Intelligence
Verdict:
Clean
Score:
89.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67c05afd2dfba428b46ec50f
Tags:
n/a
Result
Verdict:
Unknown
File Type:
PE File
Link:
https://app.docguard.net/dff1858beb573519c464988a2c93a5d5b50e8fc2fb123a1b1393cf1aa5c2ef2b/results/dashboard
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
fingerprint microsoft_visual_cc
Link:
https://www.filescan.io/uploads/67dd82ca5e1a77bf55d57596/reports/4eab7f84-be92-48bb-b826-e75d25f67c6c/overview
Verdict:
Suspicious
Labled as:
Malware.RisePro
Link:
https://www.hybrid-analysis.com/sample/dff1858beb573519c464988a2c93a5d5b50e8fc2fb123a1b1393cf1aa5c2ef2b
Score:
99%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/dff1858beb573519c464988a2c93a5d5b50e8fc2fb123a1b1393cf1aa5c2ef2b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dff1858beb573519c464988a2c93a5d5b50e8fc2fb123a1b1393cf1aa5c2ef2b/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=37yylc7lk42rtrdetcfcze5f2w2q5d6c7mjdugytsphrvjoc54vq._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
discovery execution
Link:
https://tria.ge/reports/250321-tcv5basshv/
Behaviour
Scheduled Task/Job: Scheduled Task
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Drops file in Windows directory
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Suspicious_Latam_MSI_and_ZIP_Files
Create hunting rule
Author:eremit4, P4nd3m1cb0y
Description:Detects suspicious .msi and .zip files used in Latam banking trojan campaigns.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

SmartLoader

zip dff1858beb573519c464988a2c93a5d5b50e8fc2fb123a1b1393cf1aa5c2ef2b

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3485117/
  
URLhaus
https://urlhaus.abuse.ch/url/3485213/
  
URLhaus
https://urlhaus.abuse.ch/url/3485212/

Comments