MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 edb0b239544441a41080f68e2df8243005d0736483fdc26450b244ac7d91e614. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


UACModuleSmokeLoader


Vendor detections: 13


Intelligence 13 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: edb0b239544441a41080f68e2df8243005d0736483fdc26450b244ac7d91e614
SHA3-384 hash: 8c71be50ebc47c0365377e6e8e7ff652d6671e0f7ddcf6422be34543dc033eb56b3b08ef9ce909ca8fa5a94dd60ed13c
SHA1 hash: 86bf32b299340a3a03bc886f49d5625518f15f1d
MD5 hash: c3c405f9dc7c96cb7026cdda190aacc3
humanhash: cat-cold-bravo-berlin
File name:random.exe
Download: download sample
Signature UACModuleSmokeLoader
Create hunting rule
File size:2'182'656 bytes
First seen:2025-05-21 18:23:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2eabe9054cad5152567f0699947a2c5b (2'852 x LummaStealer, 1'312 x Stealc, 1'026 x Healer)
ssdeep 49152:oxlMRBSxSIY7aYFXO8C/Fvbo/bvkwrGUEoUDjBS6pv:KauYo8C/FOkw4
Threatray 1 similar samples on MalwareBazaar
TLSH T128A533854A27B4FDD56DC432C23B36547B720A697A97CE0B7B3EE4120927290E78BD30
TrID 27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
20.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
18.6% (.EXE) Win32 Executable (generic) (4504/4/1)
8.5% (.ICL) Windows Icons Library (generic) (2059/9)
8.3% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter aachum
Tags:exe UACModuleSmokeLoader


Avatar
iamaachum
http://185.156.72.2/files/ebash/random.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
444
Origin country :
ES ES
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
random.exe
Verdict:
Malicious activity
Analysis date:
2025-05-21 18:25:36 UTC
Tags:
themida
Link:
https://app.any.run/tasks/54d6bc17-3725-4450-866a-326cec1feeb3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=682e1d43c28c67d66643b8dd
Tags:
vmdetect spoof
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Searching for analyzing tools
Rewriting of the hard drive's master boot record
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
packed packed packer_detected
Link:
https://www.filescan.io/uploads/682e1a93fd02ed5e0580c413/reports/4a615e0e-b10c-42ba-a795-d1883918b41e/overview
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/edb0b239544441a41080f68e2df8243005d0736483fdc26450b244ac7d91e614
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/3a84a23b-08af-4d4d-9fc6-87b182202e70
Result
Threat name:
n/a
Detection:
malicious
Classification:
expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1696196
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to infect the boot sector
Detected unpacking (changes PE section rights)
Hides threads from debuggers
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/edb0b239544441a41080f68e2df8243005d0736483fdc26450b244ac7d91e614
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/edb0b239544441a41080f68e2df8243005d0736483fdc26450b244ac7d91e614/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-05-21 18:25:24 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
23 of 24 (95.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5wyleokuira2ieea62hc36begac5a43eqp64ezcqwjcky7mr4yka._file
Verdict:
malicious
Label(s):
pitou
Create hunting rule
Similar samples:
edb0b239544441a41080f68e2df8243005d0736483fdc26450b244ac7d91e614
UACModuleSmokeLoader
error
UACModuleSmokeLoader
Result
Malware family:
n/a
Score:
  9/10
Tags:
bootkit defense_evasion discovery persistence
Link:
https://tria.ge/reports/250521-w2r53afq31/
Behaviour
Suspicious behavior: EnumeratesProcesses
System Location Discovery: System Language Discovery
Suspicious use of NtSetInformationThreadHideFromDebugger
Writes to the Master Boot Record (MBR)
Checks BIOS information in registry
Identifies Wine through registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Unpacked files
SH256 hash:
edb0b239544441a41080f68e2df8243005d0736483fdc26450b244ac7d91e614
MD5 hash:
c3c405f9dc7c96cb7026cdda190aacc3
SHA1 hash:
86bf32b299340a3a03bc886f49d5625518f15f1d
Link:
https://www.unpac.me/results/85251148-4dfc-46c8-ba40-aa61c3414d66/
SH256 hash:
3ebf4c1c3a6bcb44af928a226482df946ac1e75cae763103a155ccea3a15ea99
MD5 hash:
4980a878ca36fb5f6bf2b0a2898ed667
SHA1 hash:
4cf3d1a295061a92874932695acc1a527f92a744
Detections:
INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Link:
https://www.unpac.me/results/85251148-4dfc-46c8-ba40-aa61c3414d66/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/edb0b2395444/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/edb0b239544441a41080f68e2df8243005d0736483fdc26450b244ac7d91e614

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ICMLuaUtil_UACMe_M41
Create hunting rule
Author:Marius 'f0wL' Genheimer <hello@dissectingmalwa.re>
Description:A Yara rule for UACMe Method 41 -> ICMLuaUtil Elevated COM interface
Reference:https://github.com/hfiref0x/UACME
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:smokeloader_uac_module
Create hunting rule
Author:Nikolaos 'n0t' Totosis
Description:UAC bypass/file dropped by Smokeloader
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:Windows_Generic_Threat_5fbf5680
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

UACModuleSmokeLoader

Executable exe edb0b239544441a41080f68e2df8243005d0736483fdc26450b244ac7d91e614

(this sample)

  
Link
https://tria.ge/250521-wfpstazmv4/behavioral1
  
Dropped by
Amadey
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3547831/

Comments