{
  "name": "GetSmoked:  UAC-0006 Returns With SmokeLoader Targeting Ukraine's Largest State-Owned Bank",
  "slug": "getsmoked-uac-0006-returns-with-smokeloader-targeting-ukraines-largest-state-owned-bank",
  "description": "UAC-0006, a financially motivated cyber threat group, has resurfaced with a sophisticated phishing campaign targeting customers of Ukraine\u2019s largest state-owned bank, PrivatBank.",
  "published": "2025-02-10T19:44:08+00:00",
  "created_at": "2025-02-10T19:44:08+00:00",
  "modified_at": "2025-02-10T19:57:52+00:00",
  "created_at_opencti": "2025-02-10T19:44:08+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-02-10",
    "anunak",
    "bank",
    "black basta",
    "carbanak",
    "defense evasion",
    "demo",
    "fin7",
    "javascript",
    "model",
    "powershell",
    "privatbank",
    "sha256",
    "smokeloader",
    "uac-0006",
    "uac0006",
    "ukraine",
    "vbscript"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "89.23.107.219"
      },
      {
        "id": "",
        "name": "109.70.26.37"
      },
      {
        "id": "",
        "name": "94.156.177.51"
      },
      {
        "id": "",
        "name": "http://spotcarservice.ru/fdjskf88cvt/yumba/putty.exe"
      },
      {
        "id": "",
        "name": "http://spotcarservice.ru/fdjskf88cvt/putty1.exe"
      },
      {
        "id": "",
        "name": "http://spotcarservice.ru/fdjskf88cvt/invoce2.pdf"
      },
      {
        "id": "",
        "name": "http://spotcarservice.ru/fdjskf88cvt/invoce.pdf"
      },
      {
        "id": "",
        "name": "http://cityutl.ru/download/putty.exe"
      },
      {
        "id": "",
        "name": "http://cityutl.ru/download/pax.pdf"
      },
      {
        "id": "",
        "name": "http://89.23.107.219/privat.exe"
      },
      {
        "id": "",
        "name": "http://89.23.107.219/invoce.pdf"
      },
      {
        "id": "",
        "name": "http://89.23.107.219/final.mp4"
      },
      {
        "id": "",
        "name": "http://3-zak-media.de/krayer-buergerschaft/Web/bilder/putty1.exe"
      },
      {
        "id": "",
        "name": "http://3-zak-media.de/temp/paxynok_privatbank_06_01_2025p.zip"
      },
      {
        "id": "",
        "name": "http://3-zak-media.de/temp/gate.php"
      },
      {
        "id": "",
        "name": "spotcarservice.ru"
      },
      {
        "id": "",
        "name": "cityutl.ru"
      },
      {
        "id": "",
        "name": "restructurisationservice.ru"
      },
      {
        "id": "",
        "name": "constractionscity1991.lat"
      },
      {
        "id": "",
        "name": "connecticutproperty.ru"
      },
      {
        "id": "",
        "name": "f72f2e0f0873885313dbde954f26acd1c02ed963512111b3f00cf7e9cd6e5e6d"
      },
      {
        "id": "",
        "name": "f4222b240f88d43e6c63b9d9c09d93c10ba882b91fc4a61c0cd833f7c79b4c44"
      },
      {
        "id": "",
        "name": "f1d97e23cb0820e851d457dbb930576890e5bc6313cdf30d09f160cbdcdac90f"
      },
      {
        "id": "",
        "name": "ee5a55588bbdfe6749da1962a9b7d1b29a87a10a324347070edd9e8ec33f7c82"
      },
      {
        "id": "",
        "name": "e8b08cb0774145ac432406f5e579aabaddb485ad29ba7d1eb1c5fb3000c5eefa"
      },
      {
        "id": "",
        "name": "e0c57518aeef787bcf7cc13484486cfa48458bdf6b0baee02598e777a3ef83f2"
      },
      {
        "id": "",
        "name": "dada50182ca98f75e0055f9b4a47d8ef3a6dda5c126cac309467c02257f3c1c0"
      },
      {
        "id": "",
        "name": "d35cd24668474580161008eb655ce979400e382a58f0e6967b10a4d86343b6ec"
      },
      {
        "id": "",
        "name": "d143873322c13496b2fc580c07fead99c1679afe831202913cee522d88ff7795"
      },
      {
        "id": "",
        "name": "cd8dc77de5811a6a215e74cf61b3c34fcf28d5a05df5e4fc26fc9ad2ee72868b"
      },
      {
        "id": "",
        "name": "bfc7164ed334044c780f0f15b56b559dfabbb0007ba268c180a281ac5bcc1f19"
      },
      {
        "id": "",
        "name": "ca90047f4c8b5c6628e38f11c1b3411ac8f0040a2d72e35c1a37de1d9a127131"
      },
      {
        "id": "",
        "name": "b815638024caac8bb7e482465564ec2a091f2af52cbf635be268e9093cbc4e92"
      },
      {
        "id": "",
        "name": "a3aac43dd6a592c9ec58121a09c8cd22fb1b2d05ca1ff91259e43565d5e33022"
      },
      {
        "id": "",
        "name": "b62d21ec1f54e7f7d343bc836e87a13adf9f40f87fc54a7d3788baea9a2c2b08"
      },
      {
        "id": "",
        "name": "a2b10deef491ec1430f65157a411a47de0e9ad1431518b2fa4fe5f18a4f3e2bd"
      },
      {
        "id": "",
        "name": "993518e45c78f9cc19daefbabef980e2e16a5e2fa11036f1e98c6446efb38676"
      },
      {
        "id": "",
        "name": "9aad92a2d4b310a344f102436f12d29c7ac635478918874181a18182e4f530b4"
      },
      {
        "id": "",
        "name": "97fe6b08d8a40c1f6990ca5c7405fdc98e014cf1fdfc2646580bffd34c1160ec"
      },
      {
        "id": "",
        "name": "8a6466093bc38a5d075148fde75952372ab5d7bb991b74773d5e019e0e0145f0"
      },
      {
        "id": "",
        "name": "80c450570cd338a594546f9e6c189ffc2a849d3bac3759c53592af30840ffb90"
      },
      {
        "id": "",
        "name": "7c3a1bbbcbd2a328d8fb70efbdc55efaeb23b8511955109facef5c6c20350afb"
      },
      {
        "id": "",
        "name": "7722151293bdc50640c719a55438ffd663a3d2bccc70392cdce8052b651afea0"
      },
      {
        "id": "",
        "name": "75f20c4171c699a991c45671b46174b0879e1fcf83ee4cdc63af8d6a833698b3"
      },
      {
        "id": "",
        "name": "6d29acbbaf0c75eca458e3936dea7d20fceca415b897573b704d151c7e9261b8"
      },
      {
        "id": "",
        "name": "5b259a3ce6c0ce88690eb15d71162a930f267d960e26e88d37c92403d747f44a"
      },
      {
        "id": "",
        "name": "5a0b48ccc1a353c4ace5e9626f17622611432a016577797d4c891ca945ffa7f8"
      },
      {
        "id": "",
        "name": "527a4b00fc95ecb9c1308ccc4ebd6bac7c03053e8ed11cdeb08ac3a6af8775c3"
      },
      {
        "id": "",
        "name": "4abf59022d70abac175ddd896e4d709d256ca56a7a9dd8a9805eb5f2af490576"
      },
      {
        "id": "",
        "name": "4a559be38d60d64cb378643cc4332f40fe94d5f6c4f71a4f593e4efcd918349c"
      },
      {
        "id": "",
        "name": "476a8e2d8eae4d2315e719bf67be312c5e88476509bdbac2dffee48986ad54c1"
      },
      {
        "id": "",
        "name": "3998a0d2e96417ce234a79897df8bcb879295043ce3d7f188c7b3de7375b26e5"
      },
      {
        "id": "",
        "name": "3bfb1a880ea62bb4ad24e98a3a641b85e2392942af59727701c57ed094e5554e"
      },
      {
        "id": "",
        "name": "31ba8ceffe689b570dc696c97291780288f16a15f91d3e55bf13d7dcdf3858a9"
      },
      {
        "id": "",
        "name": "3216f4728788cc9a0416290d31a2fdc97bcd3f028582efc52dc1cd8208f0cebd"
      },
      {
        "id": "",
        "name": "38eb41eebbc889d046d354de345cf7c073971f62c2aaf53163ecefb7914273cc"
      },
      {
        "id": "",
        "name": "21bbe1929d20c5525349dabe58748798f9cdaa1abd25f13dc98b4c0b8ffdde23"
      },
      {
        "id": "",
        "name": "119b79b9cdb773dc951c36fe35ea0237e5f035bda6493103399e3697dc929c3d"
      },
      {
        "id": "",
        "name": "107190bb8f28ed2bb2f0883ae1fbfe0e50cacc54c17dc526c865f6f46f40107a"
      },
      {
        "id": "",
        "name": "1043ce610dd6e8b0cda635dbe1f15524c25d816f89ad22f9bc34403ef8e771cc"
      },
      {
        "id": "",
        "name": "0a898f1df135d52ef5006f8dba9e9fce4ab4a85e07a9417f39c7612113eb6210"
      },
      {
        "id": "",
        "name": "9833cbd22fd50181f8939114920e883bacf8d727337f5dcdf4450d0312eca188"
      }
    ],
    "malware": [
      {
        "id": "308c071f-cfbe-411d-a6a6-caa8b5b3fd9d",
        "name": "UAC-0006",
        "slug": "uac-0006"
      },
      {
        "id": "e43f492c-eed6-4b62-9ff0-d242b45590d6",
        "name": "Demo",
        "slug": "demo"
      },
      {
        "id": "c565a1bc-b917-4e4b-9106-e41ccbbece44",
        "name": "SmokeLoader",
        "slug": "smokeloader"
      }
    ],
    "intrusion_sets": [
      {
        "id": "119a6a64-dcfe-4bb3-8ca4-7ce67623d316",
        "name": "UAC-0006",
        "slug": "uac-0006"
      }
    ],
    "attack_patterns": [
      {
        "id": "16e26db7-7376-40c1-b8a9-23d56c44f7ee",
        "name": "T1571"
      },
      {
        "id": "743d2e0c-e5d5-4ccb-a6bd-0035c4e88c37",
        "name": "T1176"
      },
      {
        "id": "926a888c-190c-4efb-ab6b-f9d7e6a0fc54",
        "name": "T1547"
      },
      {
        "id": "a7262c61-4567-4a00-8cec-aae6264234a9",
        "name": "T1218"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "358e04b8-6f65-48b2-a24b-f101bfc6671a",
        "name": "T1195"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "74d6e294-54d1-4a21-9dfc-df5870f8ec8e",
        "name": "T1003"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Ukraine"
      },
      {
        "id": "",
        "name": "Critical Systems"
      },
      {
        "id": "",
        "name": "Financial"
      }
    ]
  },
  "external_refs": [
    "https://www.cloudsek.com/blog/getsmoked-uac-0006-returns-with-smokeloader-targeting-ukraines-largest-state-owned-bank",
    "https://otx.alienvault.com/pulse/67aa651978bbd23777b3db68"
  ]
}