MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7910bc87f0092c72a683ae1bb28ed7ba91077bdfe38dc82376f154b2ccf022d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e7910bc87f0092c72a683ae1bb28ed7ba91077bdfe38dc82376f154b2ccf022d
SHA3-384 hash:	dc6811304cea6846e0633bfbfbba057a8d6487db09d52fd8c70db8fe3f915f4a36be840e7f576a2879df865cf9d7de93
SHA1 hash:	6c6af32600fec1d6b2943575dc677730ad4cbabb
MD5 hash:	2fbdb71b741486645ef165cc71a7f725
humanhash:	november-nineteen-venus-skylark
File name:	2fbdb71b741486645ef165cc71a7f725.exe
Download:	download sample
Signature	UACModuleSmokeLoader Alert Create hunting rule
File size:	630'784 bytes
First seen:	2023-07-31 07:25:39 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	432f9474f351967236c075f6f3bbd792 (3 x RedLineStealer, 2 x Smoke Loader, 1 x GurcuStealer)
ssdeep	12288:qRY5MY5K8z1VOn8tXzDPiXTvicKpwuQxaH2Fu2Dv:qRKHRVG8B/PKvicSRGB82Dv
Threatray	46 similar samples on MalwareBazaar
TLSH	T17FD49EC3A2A17D54E9264B32DE1FC2E8761DF6918F89BB6532599E2B04F10F2E173710
TrID	37.3% (.EXE) Win64 Executable (generic) (10523/12/4) 17.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 16.0% (.EXE) Win32 Executable (generic) (4505/5/1) 7.3% (.ICL) Windows Icons Library (generic) (2059/9) 7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	0030c0b030301000 (1 x UACModuleSmokeLoader)
Reporter	abuse_ch
Tags:	exe UACModuleSmokeLoader

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

313

Origin country :

NL

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

2fbdb71b741486645ef165cc71a7f725.exe

Verdict:

Malicious activity

Analysis date:

2023-07-31 07:36:16 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/a0763938-1aab-4ec1-aeb9-24d957919292

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/439371/

ClamAV Detected

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

azorult diskwriter greyware packed

Link:

https://www.filescan.io/uploads/64c762112e037e88653f25eb/reports/88324f3f-df2a-4ad9-9302-31a43c0d3247/overview

Hybrid Analysis Win/malicious_confidence_100%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/e7910bc87f0092c72a683ae1bb28ed7ba91077bdfe38dc82376f154b2ccf022d

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Pitou

Malware family:

Pitou

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9c7dbce9-5e69-490d-8a83-43b7bfe33865

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/1282976

Signature

Contains functionality to infect the boot sector

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e7910bc87f0092c72a683ae1bb28ed7ba91077bdfe38dc82376f154b2ccf022d/

ReversingLabs TitaniumCloud Win32.Trojan.RedLine

Threat name:

Win32.Trojan.RedLine

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-07-30 07:42:33 UTC

File Type:

PE (Exe)

Extracted files:

67

AV detection:

21 of 24 (87.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=46iqxsd7acjmoktihlq3wkhnpoura5557y4nzarxn4kuwlgpaiwq._file

Threatray malicious

Verdict:

malicious

Similar samples:

0492bb7752122b4c35a9d914b96318401ec1c187739aea0231ea54e7cbeebc76

UACModuleSmokeLoader

0c8fcb4201e67579906b7a3512f0f093297231ecad2b949a7b41d377f22b5d56

UACModuleSmokeLoader

17745cf313048c8618b348f3ed48abf6dc440e956a33ffdb252e53d6c05062a4

UACModuleSmokeLoader

2d7177d54baa36a8fccce112fc5a08d2126bc6a066111f303612c2d35b6b209c

UACModuleSmokeLoader

375f623741fe071117c32d8e027f9a705ab54586b12ee5504a56d2205e95b38c

UACModuleSmokeLoader

46a218a16190914c66dbcdf1a8c0d35aa3d0bc246b6cf16075567c85340bd33f

UACModuleSmokeLoader

975ebd15c72754378f2a55d809a321666db1b68a69e6fbfb6ae19813f7809ca9

UACModuleSmokeLoader

a26f4095e16974985cf573f1bc35991273b9383eb5ce20cfaf46c004cd6498b1

UACModuleSmokeLoader

c98b767c0ceb5c2bc05e873a06f0f264d8f7e42fd51c475e8595514d8b81f09f

UACModuleSmokeLoader

d68839827fc159c514d91b76e31f3ec0f665a1e577433c11955acb5b4fce2057

UACModuleSmokeLoader

+ 36 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

bootkit persistence

Link:

https://tria.ge/reports/230731-h9jl1aec4z/

Behaviour

Writes to the Master Boot Record (MBR)

UnpacMe 2

Unpacked files

SH256 hash:

87f776743f1852705d418c3627744380019e9d63dd70737962f56bd2f1ff107a

MD5 hash:

beb1f632da458d8cdd00103654be92c9

SHA1 hash:

3cd539f2cb3a2f2cfbc1943a32432bfbc7f81b96

Link:

https://www.unpac.me/results/eccb493e-7b9b-4b0f-9fb1-7bbdcdb9d0ec/

SH256 hash:

e7910bc87f0092c72a683ae1bb28ed7ba91077bdfe38dc82376f154b2ccf022d

MD5 hash:

2fbdb71b741486645ef165cc71a7f725

SHA1 hash:

6c6af32600fec1d6b2943575dc677730ad4cbabb

Link:

https://www.unpac.me/results/eccb493e-7b9b-4b0f-9fb1-7bbdcdb9d0ec/

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/e7910bc87f00/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

UACModuleSmokeLoader

exe e7910bc87f0092c72a683ae1bb28ed7ba91077bdfe38dc82376f154b2ccf022d

(this sample)

  

URLhaus

https://urlhaus.abuse.ch/url/2628134/

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/439371/