MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 efba2de295c36fdc508476c47d57ad557f8381bf2d11d436bb0863b40b3e3fce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	efba2de295c36fdc508476c47d57ad557f8381bf2d11d436bb0863b40b3e3fce
SHA3-384 hash:	49b33fa22b4e0a2e386221f1fd96bfd2976929448ae1f8579c8f03c65437fc4bf99e9266c6f158c6ee5a5c8ee69a02d0
SHA1 hash:	765c8a222f3fb3ba60646e096bae91b76df248b8
MD5 hash:	cd68bfc6475f0ac4f5d0994350b210cb
humanhash:	magazine-purple-burger-nuts
File name:	file
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	2'075'624 bytes
First seen:	2026-02-10 23:07:19 UTC
Last seen:	2026-02-10 23:18:05 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	e440c7009792917cfecbaeda0053d5b9 (1 x Smoke Loader)
ssdeep	24576:yatO7gM/5KlRUjKJoYV/g82Qf9OveL6IHhUBwYOey5YXhQKkJFVOf/THmU2Pro5s:vOkM/SRUKJoY+8r8OhUzdyosO37H2PsK
TLSH	T108A5E026397D72D2E4C942B180D0B6033FB8FDB54B890C5A67C8B6B61C39B963F9E055
TrID	44.4% (.EXE) Win64 Executable (generic) (10522/11/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	Bitsight
Tags:	dropped-by-amadey exe fbf543 signed Smoke Loader

Code Signing Certificate

Organisation:	SynthLabs-Strategy
Issuer:	SynthLabs-Strategy
Algorithm:	sha256WithRSAEncryption
Valid from:	2026-02-09T18:13:16Z
Valid to:	2028-02-10T18:13:16Z
Serial number:	27c9006b04949423
Thumbprint Algorithm:	SHA256
Thumbprint:	ee04736ee5b2c66d2ad7094f3d0ccb6e86d519b77994e2af7e8a5b5344e8e31c
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Bitsight

url: http://130.12.180.43/files/8432081020/btZfO26.exe

Intelligence

File Origin

# of uploads :

# of downloads :

114

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2026-02-10 23:08:09 UTC

Tags:

stealer

Link:

https://app.any.run/tasks/10ef8cc3-a0fb-4bd2-9593-f7f1f2aa9b6b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/52952/

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=698bba2a38c84aca0d32bd19

Tags:

n/a

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug installer-heuristic keylogger krypt packed signed

Link:

https://www.filescan.io/uploads/698bba60930564ff3c9832c7/reports/45ec911a-45ac-4031-bec5-ac5b4153ada3/overview

Verdict:

Malicious

Labled as:

Trojan/W64.Agent

Link:

https://www.hybrid-analysis.com/sample/efba2de295c36fdc508476c47d57ad557f8381bf2d11d436bb0863b40b3e3fce

Result

Gathering data

Verdict:

Clean

File Type:

exe x64

Link:

https://opentip.kaspersky.com/efba2de295c36fdc508476c47d57ad557f8381bf2d11d436bb0863b40b3e3fce/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/061742bf-92f3-46b3-8793-a0361f7c2345

Score:

87%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/efba2de295c36fdc508476c47d57ad557f8381bf2d11d436bb0863b40b3e3fce

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/cd68bfc6475f0ac4f5d0994350b210cb

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/efba2de295c36fdc508476c47d57ad557f8381bf2d11d436bb0863b40b3e3fce/

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/efba2de295c36fdc508476c47d57ad557f8381bf2d11d436bb0863b40b3e3fce

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=565c3yuvynx5yueeo3ch2v5nkv7yhan7fui5inv3bbr3icz6h7ha._file

Result

Malware family:

n/a

Score:

7/10

Tags:

discovery spyware stealer

Link:

https://tria.ge/reports/260210-24nhjsey4h/

Behaviour

Suspicious behavior: EnumeratesProcesses

Browser Information Discovery

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

Unpacked files

SH256 hash:

efba2de295c36fdc508476c47d57ad557f8381bf2d11d436bb0863b40b3e3fce

MD5 hash:

cd68bfc6475f0ac4f5d0994350b210cb

SHA1 hash:

765c8a222f3fb3ba60646e096bae91b76df248b8

Link:

https://www.unpac.me/results/4ad33e0f-5abb-4f12-a4e8-3298be616c76/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/efba2de295c3/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.