MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ec20550754890947272134381fe1835e31d40c84d5b696eec35d53355ddb9d3f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Smoke Loader
Vendor detections: 21
| SHA256 hash: | ec20550754890947272134381fe1835e31d40c84d5b696eec35d53355ddb9d3f |
|---|---|
| SHA3-384 hash: | 5bb563f332229432f505fd5cfaf9b24c5df11c3f518d90f26babde66d301b5f65adfcc5817c0e0dc3438246c0356363a |
| SHA1 hash: | a37f4d6de7c68d2f95a5e401e4b4591e023d76ef |
| MD5 hash: | cc1f27309178eb21af09ba7af4201339 |
| humanhash: | august-cold-lamp-tennis |
| File name: | ec20550754890947272134381fe1835e31d40c84d5b696eec35d53355ddb9d3f |
| Download: | download sample |
| Signature | Smoke Loader |
| File size: | 404'992 bytes |
| First seen: | 2025-12-15 08:14:24 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 1b6bf90fc7c5a921cc63a5ad9894e60f (1 x Smoke Loader) |
| ssdeep | 6144:BALw2gITwPqOSUHGM5qr0cQ7m8w4zRKYa212K8dEW6w+6TyCt7K2TT:289U2VGMqel3zHaU2KdwvlpH |
| Threatray | 1'604 similar samples on MalwareBazaar |
| TLSH | T15084F11079E0D073C5A392759874D9B16DBFB8B396B5858B37982F7E2E302D35A36302 |
| TrID | 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10522/11/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1) |
| Magika | pebin |
| Reporter |  Threatray |
| Tags: | exe Shanya Smoke Loader SmokeLoader |
Intelligence
File Origin
# of uploads :
1
# of downloads :
90
Origin country :
DEVendor Threat Intelligence
Malware configuration found for:
AceCryptor
SmokeLoader
Details
AceCryptor
an extracted payload
AceCryptor
an extracted shellcode loader component and the ms_c_rand-XOR seed
AceCryptor
an extracted shellcode loader component and a TEA decryption key
SmokeLoader
c2 urls and a version number
SmokeLoader
an extracted component
Malware family:
smoke
ID:
1
File name:
ec20550754890947272134381fe1835e31d40c84d5b696eec35d53355ddb9d3f.exe
Verdict:
Malicious activity
Analysis date:
2025-12-15 08:18:20 UTC
Tags:
smoke loader smokeloader
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
SmokeLoader
Detection(s):
Verdict:
Malicious
Score:
99.1%
Tags:
phishing virus zusy hype
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
anti-debug anti-vm crypt fingerprint microsoft_visual_cc overlay overlay packed stealc zero zusy
Verdict:
Malicious
Labled as:
Trojan/Stealc
Verdict:
Malicious
File Type:
exe x32
First seen:
2024-11-27T21:17:00Z UTC
Last seen:
2025-12-15T10:09:00Z UTC
Hits:
~10
Detections:
PDM:Trojan.Win32.Generic HEUR:Trojan.Win32.Agent.gen
Malware family:
Malicious Packer
Verdict:
Malicious
Score:
100%
Verdict:
Malware
File Type:
PE
Gathering data
Detection:
smokeloader
Verdict:
Malicious
Threat:
Family.SMOKELOADER
Threat name:
Win32.Trojan.Stealc
Status:
Malicious
First seen:
2024-12-28 12:46:00 UTC
File Type:
PE (Exe)
Extracted files:
9
AV detection:
27 of 36 (75.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
shellcode_loader_002
shanyapacker
smokeloader
Similar samples:
+ 1'594 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Score:
10/10
Tags:
family:smokeloader botnet:pub4 backdoor discovery persistence trojan
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
System Location Discovery: System Language Discovery
Deletes itself
SmokeLoader
Smokeloader family
Malware Config
C2 Extraction:
http://obozintsev.ru/tmp/index.php
http://olovge.at/tmp/index.php
http://nuxc.cc/tmp/index.php
http://piratekings.online/tmp/index.php
http://olovge.at/tmp/index.php
http://nuxc.cc/tmp/index.php
http://piratekings.online/tmp/index.php
Verdict:
Malicious
Tags:
Win.Packer.pkr_ce1a-9980177-0
YARA:
n/a
Unpacked files
SH256 hash:
ec20550754890947272134381fe1835e31d40c84d5b696eec35d53355ddb9d3f
MD5 hash:
cc1f27309178eb21af09ba7af4201339
SHA1 hash:
a37f4d6de7c68d2f95a5e401e4b4591e023d76ef
SH256 hash:
1e60f66aeaf44cc34ba1d34c447bdac76caca57cf0b8e04b4b590719d720b044
MD5 hash:
164849cec1942ddc166655bd7932f9fb
SHA1 hash:
881cecf9bbb870957f24521a82ac7b75a1913a2b
Detections:
win_smokeloader_a2
SmokeLoaderStage2
Malware family:
SmokeLoader
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | Check_OutputDebugStringA_iat |
|---|
| Rule name: | DebuggerCheck__API |
|---|---|
| Reference: | https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara |
| Rule name: | golang_bin_JCorn_CSC846 |
|---|---|
| Author: | Justin Cornwell |
| Description: | CSC-846 Golang detection ruleset |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.