MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 04b094e1e2f34f1382df94fa610e9e74a74e6a73c8b755285a70f60da73b392d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 04b094e1e2f34f1382df94fa610e9e74a74e6a73c8b755285a70f60da73b392d
SHA3-384 hash: dbe679b6240510201d832455c813520a7be6797bb477d7f84f5110356acff2fc411aff9917742877d126a7c09d286c68
SHA1 hash: 1b4fba305c0a667058b0f805425797245a5851eb
MD5 hash: a4fe313256e5477d41af77aa45c65f20
humanhash: mirror-queen-west-happy
File name:a4fe313256e5477d41af77aa45c65f20.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:280'576 bytes
First seen:2021-08-23 17:53:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5c06a288f07d43206aca52d5d94444b2 (5 x Amadey, 1 x RedLineStealer, 1 x Smoke Loader)
ssdeep 6144:oM/h4ZNWiadxDfDxeypXM2RgaKPsr9zsC:Th0NzC5fxpXMWgaD9z
Threatray 1'251 similar samples on MalwareBazaar
TLSH T12F547C30ABA1C035F1F711F455B683B8A93A7AB16B7450CB93D52AEE16346E4EC30B47
dhash icon ead8ac9cc6e68ee0 (118 x RaccoonStealer, 102 x RedLineStealer, 46 x Smoke Loader)
Reporter abuse_ch
Tags:Dofoil exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'291
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a4fe313256e5477d41af77aa45c65f20.exe
Verdict:
No threats detected
Analysis date:
2021-08-23 17:55:28 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a543aecf-5980-40f9-b889-83204092ab6a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/181576/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader41.25162.14773.13023.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Connection attempt
Sending an HTTP POST request
Deleting of the original file
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4fcf29e9-6515-4541-9e92-aecaa9b22880
Result
Threat name:
KPot RedLine SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/837771
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains VNC / remote desktop functionality (version string found)
Creates a thread in another existing process (thread injection)
Creates autostart registry keys with suspicious names
Deletes itself after installation
Detected unpacking (changes PE section rights)
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected KPot
Yara detected RedLine Stealer
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 470205 Sample: jzxrzyabj4.exe Startdate: 23/08/2021 Architecture: WINDOWS Score: 100 47 atvcampingtrips.com 2->47 49 api.ip.sb 2->49 51 prda.aadg.msidentity.com 2->51 73 Found malware configuration 2->73 75 Antivirus detection for URL or domain 2->75 77 Multi AV Scanner detection for submitted file 2->77 79 8 other signatures 2->79 10 jzxrzyabj4.exe 2->10         started        13 swrcire 2->13         started        signatures3 process4 signatures5 101 Detected unpacking (changes PE section rights) 10->101 103 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 10->103 105 Maps a DLL or memory area into another process 10->105 107 Creates a thread in another existing process (thread injection) 10->107 15 explorer.exe 4 10->15 injected 109 Multi AV Scanner detection for dropped file 13->109 111 Machine Learning detection for dropped file 13->111 113 Checks if the current machine is a virtual machine (disk enumeration) 13->113 process6 dnsIp7 59 193.142.59.123, 49756, 49768, 49783 HOSTSLICK-GERMANYNL Netherlands 15->59 61 atvcampingtrips.com 210.207.244.101, 49748, 49749, 49750 HIAM-AS-KRHiAssetManagementCoLtdKR Korea Republic of 15->61 63 6 other IPs or domains 15->63 39 C:\Users\user\AppData\Roaming\swrcire, PE32 15->39 dropped 41 C:\Users\user\AppData\Local\Temp\8F9D.exe, PE32 15->41 dropped 43 C:\Users\user\...\swrcire:Zone.Identifier, ASCII 15->43 dropped 65 System process connects to network (likely due to code injection or exploit) 15->65 67 Benign windows process drops PE files 15->67 69 Deletes itself after installation 15->69 71 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->71 20 70A8.exe 2 4 15->20         started        24 2381.exe 3 15->24         started        26 8F9D.exe 15 26 15->26         started        file8 signatures9 process10 dnsIp11 45 C:\ProgramData\...\33A2E4F0.exe, PE32 20->45 dropped 81 Detected unpacking (changes PE section rights) 20->81 83 Creates autostart registry keys with suspicious names 20->83 29 33A2E4F0.exe 20->29         started        85 Query firmware table information (likely to detect VMs) 24->85 87 Tries to detect sandboxes and other dynamic analysis tools (window names) 24->87 89 Hides threads from debuggers 24->89 91 Tries to detect sandboxes / dynamic malware analysis system (registry check) 24->91 33 conhost.exe 24->33         started        53 185.215.113.29, 49763, 8678 WHOLESALECONNECTIONSNL Portugal 26->53 55 api.ip.sb 26->55 93 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 26->93 95 Machine Learning detection for dropped file 26->95 97 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 26->97 99 Tries to harvest and steal browser information (history, passwords, etc) 26->99 35 conhost.exe 26->35         started        file12 signatures13 process14 dnsIp15 57 ebanat6977769.com 206.54.191.4, 49789, 80 WZCOM-US United States 29->57 115 Detected unpacking (changes PE section rights) 29->115 117 Machine Learning detection for dropped file 29->117 119 Maps a DLL or memory area into another process 29->119 121 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 29->121 37 lsass.exe 29->37 injected signatures16 process17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/04b094e1e2f34f1382df94fa610e9e74a74e6a73c8b755285a70f60da73b392d/
Threat name:
Win32.Trojan.Fragtor
Create hunting rule
Status:
Malicious
First seen:
2021-08-23 17:54:09 UTC
AV detection:
24 of 46 (52.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=asyjjypc6nhrhaw7st5gcdu6ostu42ttzc3vkkc2od3a3jz3hewq._file
Verdict:
suspicious
Similar samples:
06d2ef3f80066d655c788069de3098105f6128e388e43baf73e2d9bf69365ce3
Smoke Loader
1d76266267ca27570b9cfb6f2a84b80ef607e9450d475eabad2e630cfbd77b7e
Smoke Loader
328e682510e9c0e0c37a7c8d347ecb4e7791a03b44962675a3f5f23d85250e08
Smoke Loader
39326cdd0c863e1766ecc3d119ec18fdaa93ef886cfbc887f76784f745df73e4
Smoke Loader
41ce43aa875bf977ec9eb039e5853ade1af522dd0dff4f19282f6c8038ae2dff
Smoke Loader
5f0caccb3ca599a30b5f298f9bb414fe721121c83b7bedc7c59ffe4128c96b61
Smoke Loader
c5fc8453bf6cdd3e96740b1616ba2f6b359710ce2eb32f02faf8c0e299a0a057
Smoke Loader
c7839db336f11c965ab8e6fbad1a6c757711a24362cc20d63d4ce37aef9b83b1
Smoke Loader
cf8a60b5e39660a02d37d4d5f1d28e392427c1da05142d4a651cd1c267d07cc1
Smoke Loader
+ 1'241 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:raccoon family:redline family:smokeloader botnet:fd34ae8fb78d0554aa7caf12c271e01efb3342f6 backdoor infostealer stealer trojan
Link:
https://tria.ge/reports/210823-wsg5ffd3ra/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Loads dropped DLL
Downloads MZ/PE file
Executes dropped EXE
Raccoon
RedLine
RedLine Payload
SmokeLoader
Malware Config
C2 Extraction:
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
185.215.113.29:8678
Unpacked files
SH256 hash:
18cd8e90fcd46329480f24d43baa489683b3ee2fcd274bf1714947ef307a6ab2
MD5 hash:
f2fecf6872ad4c61a3a506159fddd4fc
SHA1 hash:
28e039eb96dcf58841992280c66433a2bbab8e84
Link:
https://www.unpac.me/results/759bb3b6-e3e9-4e49-8b5b-b3ed20036c40/
SH256 hash:
04b094e1e2f34f1382df94fa610e9e74a74e6a73c8b755285a70f60da73b392d
MD5 hash:
a4fe313256e5477d41af77aa45c65f20
SHA1 hash:
1b4fba305c0a667058b0f805425797245a5851eb
Link:
https://www.unpac.me/results/759bb3b6-e3e9-4e49-8b5b-b3ed20036c40/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/04b094e1e2f34f1382df94fa610e9e74a74e6a73c8b755285a70f60da73b392d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 04b094e1e2f34f1382df94fa610e9e74a74e6a73c8b755285a70f60da73b392d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1545011/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/181576/

Comments