MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 01c01aae7732121882acd82c0538f17517f020fb7c6ef81e41c9c2625e4f8aa9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 11

Intelligence 11 IOCs YARA File information Comments

SHA256 hash:	01c01aae7732121882acd82c0538f17517f020fb7c6ef81e41c9c2625e4f8aa9
SHA3-384 hash:	35e4126c968493099f8236d2941b414085f24eeb7e19f4d88deb724fd0937d58548e7d6573c4cb6feb4d0be14478dcb7
SHA1 hash:	873e7c48048df390087bd6f333441bfc6b538d05
MD5 hash:	ff526792a21e22b97806ab5cfa83fbba
humanhash:	edward-india-six-bravo
File name:	ff526792a21e22b97806ab5cfa83fbba.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	163'328 bytes
First seen:	2021-11-20 09:57:48 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	d447c88e5ba79016e49c5de135738a35 (5 x Smoke Loader, 3 x ArkeiStealer, 2 x RedLineStealer)
ssdeep	3072:O7Y4z1YII+Q9NTHp2DD7w0Lu3MbqG8es6ybHB:gWII+Q9N7pgD7BLQM2Dd9H
Threatray	202 similar samples on MalwareBazaar
TLSH	T135F39D2137F1C072E4E77630197186AB2A3BB973A671458B2F68162E3E307D049A5F57
File icon (PE):
dhash icon	fcfcd4d4d4d4d8c0 (75 x RedLineStealer, 56 x RaccoonStealer, 23 x Smoke Loader)
Reporter	abuse_ch
Tags:	exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

201

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

ff526792a21e22b97806ab5cfa83fbba.exe

Verdict:

No threats detected

Analysis date:

2021-11-20 10:03:27 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/db161a11-2536-42d8-9b83-fd2c9d5b12d5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Gathering data

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Sending a custom TCP request

DNS request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Enabling autorun by creating a file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/6198c6b3f0309c84a4754967/reports/5128a908-612a-4d75-bae3-ae7d1e53e4ef/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/dbf6e564-8d84-4b95-b833-177dec133f84

Result

Threat name:

RedLine SmokeLoader

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/893072

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected RedLine Stealer

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/01c01aae7732121882acd82c0538f17517f020fb7c6ef81e41c9c2625e4f8aa9/

Threat name:

Win32.Trojan.Smokeloader

Status:

Malicious

First seen:

2021-11-19 15:16:52 UTC

AV detection:

21 of 27 (77.78%)

Threat level:

5/5

Verdict:

malicious

Smoke Loader

31199c08dabb68fd3b693528ba7803890acdea14125bb6bb8b938293da3d4666

Smoke Loader

4ad86f977388353d9c4af78a53d546182497ffdb977d3fb68ebd781ea6ffb46a

Smoke Loader

a2a15f28bc17fd686dbe76698e3fff83d84f3df5f533448b23549942bfe09b4a

Smoke Loader

a6c90b4cf3dac72a1cf401cd8995b5e8a7e11b38efb76ba1c06af7867683d76d

Smoke Loader

eac7ad1a557e26c8be44b8d3f223a764b07f346f8f7037df3614be67edeb644b

Smoke Loader

+ 192 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor trojan

Link:

https://tria.ge/reports/211120-lzhhqsfff5/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Deletes itself

Drops startup file

Loads dropped DLL

Downloads MZ/PE file

Executes dropped EXE

SmokeLoader

Malware Config

C2 Extraction:

http://membro.at/upload/
http://jeevanpunetha.com/upload/
http://misipu.cn/upload/
http://zavodooo.ru/upload/
http://targiko.ru/upload/
http://vues3d.com/upload/