MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1415378411d7d155dd8217cdc7e453dc221219b2432473d110ea65368f58f095. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 18

Intelligence 18 IOCs YARA 2 File information Comments

SHA256 hash:	1415378411d7d155dd8217cdc7e453dc221219b2432473d110ea65368f58f095
SHA3-384 hash:	9bfbc09c10aa0c9b115d62f7b3230accd9b7fb3acadc4f2980cc5417dbc81dc894620b18c0d92f5e217fd85886db85dd
SHA1 hash:	bb09fcf10894464659677dae74cda70a175b73fc
MD5 hash:	47ea03c7ed9d6fbebeb969c269765cd5
humanhash:	virginia-cold-hot-bulldog
File name:	47ea03c7ed9d6fbebeb969c269765cd5.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	255'488 bytes
First seen:	2024-09-25 05:56:01 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	3f14e3b7aefb4fc1c763f1c17e499d8c (2 x Smoke Loader, 1 x Stop)
ssdeep	1536:5Kadg+sv2U4GK230gjx+/1TUYoQLdboDQxE2ldpbj8GJ5tBK1i6bJCkirf1pbyBw:xyX43230SW9mOdMD4Ee0k5zKk0JRl
Threatray	2'567 similar samples on MalwareBazaar
TLSH	T1124408D26EA3A812EF364B724B2AC1E8791DBF419F77667D3144FA2F1473A718912301
TrID	46.6% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 25.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 8.5% (.EXE) Win64 Executable (generic) (10523/12/4) 5.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 4.0% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
File icon (PE):
dhash icon	92716d4cfcc4d4d4 (15 x Smoke Loader, 1 x GCleaner)
Reporter	abuse_ch
Tags:	exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

418

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

47ea03c7ed9d6fbebeb969c269765cd5.exe

Verdict:

Malicious activity

Analysis date:

2024-09-25 06:22:51 UTC

Tags:

loader smokeloader

Link:

https://app.any.run/tasks/230cadb1-0b1c-4794-a4d5-e1a8f107d5c8

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Trojan.Convagent-10034862-0

Win.Trojan.Stealerc-10035382-0

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66f3a5f88aca58c2b2c73321

Tags:

Network Stealth Malware Smokeloader Hype Onli

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Connection attempt to an infection source

Query of malicious DNS domain

Unauthorized injection to a system process

Enabling autorun by creating a file

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-vm azorult epmicrosoft_visual_cc fingerprint microsoft_visual_cc

Link:

https://www.filescan.io/uploads/66f3a5f628a6e83e1416743b/reports/e9e29b9a-1436-47b1-abb5-56a7cf929964/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/1415378411d7d155dd8217cdc7e453dc221219b2432473d110ea65368f58f095

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/2f43bdcb-b7da-4a54-9502-48391d652ae5

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1517835

Signature

AI detected suspicious sample

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

System process connects to network (likely due to code injection or exploit)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/1415378411d7d155dd8217cdc7e453dc221219b2432473d110ea65368f58f095

Detection:

smokeloader

Link:

https://mwdb.cert.pl/sample/1415378411d7d155dd8217cdc7e453dc221219b2432473d110ea65368f58f095/

Threat name:

Win32.Trojan.Krypter

Status:

Malicious

First seen:

2024-08-18 15:55:46 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

29 of 38 (76.32%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cqktpbar27ivlxmcc7g4pzct3qrbegnsimshhuiq5jstnd2y6ckq._file

Verdict:

malicious

Label(s):

smokeloader

shellcode_loader_002

Smoke Loader

064c59b3a8b03e6c733f88483fd675d99bc805399c55d4a1a7b613aa20d08de8

Smoke Loader

247eb6cc11d0a92ac985fb99c19dcfe4779878f4989764b8ced06727820ff57c

Smoke Loader

50ca2730d4feb93b8d6cf986a86b34912d83c10dd7d7259d3538d415c904af73

Smoke Loader

5c88a340b3b0502c9777fe6159f01d66875341dc739e23a56a21ee18479890f2

Smoke Loader

a73ee8f46c7caf4da7ea6a92dc0a11d58757a83e1b5b9c3723b49690fc238271

Smoke Loader

e629fcf41de2187cafd4c8c38b1e9408a5c521d29459971bb96fae5da26fa9d5

Smoke Loader

f518307808486c2718cd6b83e4e5f012e3531c8d352abd6d51b7311fcfa2c28c

Smoke Loader

f662b3ef913a9bfb62cb970e6f8f8e81ad75b21deaccffc01cbc1390f34e776e

Smoke Loader

+ 2'557 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader botnet:pub2 backdoor discovery trojan

Link:

https://tria.ge/reports/240925-gm1rbsyelk/

Behaviour

Checks SCSI registry key(s)

Program crash

System Location Discovery: System Language Discovery

SmokeLoader

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/d488e8a2-5d7c-4190-896a-307841bce5e3

Unpacked files

SH256 hash:

977646f31a879d2ddd9938e2f39a74653556fd970dd2fa6172f26348d18622dc

MD5 hash:

8ee858716125555e7355a2b919417a53

SHA1 hash:

20a3bfa728fe21f18f6c4f8c17c01e4bd416063e

Detections:

SmokeLoaderStage2

win_smokeloader_a2

Link:

https://www.unpac.me/results/9b974bab-af06-4261-90f4-488bae977161/

Parent samples :

3ec76b58400fa83602d35d82f38341d921223dcdf175b98bca435a59ba340464
d3e138b03be305d34d6ee21c5f4cc4d496ff447601ffb71508e23e580bd50e7c
edf20ee240507ae1f49a20f8d20deee11484c013150d6d57ae1fe8ff69e0f8d5
e75102f75f478c346b1dd2ebd56311a9d7345d3c785a6b2dc2911033a317c485
d1abb50ea4d533a3e57b99e347d5d8675896ce23576987edcc9c3426ffb0c380
acc17deb417db03958118c1ac08156e0fca081605b909644523dd3fa887cf674
88b5ed74d4fc6f2cf6394bd1766f44df61e7dc9b810cfacbecba5b34af3bf57d
76ba1d82e20b13b9d1becbb799aa68f6539092f6823f38a86ce935b0650b0556
41582c8b6bd111a2f141dee52b619d13278ef68754691263abeb3238d485f404
1c1d81eaf1a389d4dafc6ba71a3e3bfaa477a49b4d3591956cab660165648028
1415378411d7d155dd8217cdc7e453dc221219b2432473d110ea65368f58f095

SH256 hash:

1415378411d7d155dd8217cdc7e453dc221219b2432473d110ea65368f58f095

MD5 hash:

47ea03c7ed9d6fbebeb969c269765cd5

SHA1 hash:

bb09fcf10894464659677dae74cda70a175b73fc

Link:

https://www.unpac.me/results/9b974bab-af06-4261-90f4-488bae977161/

Malware family:

SmokeLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/1415378411d7/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1415378411d7d155dd8217cdc7e453dc221219b2432473d110ea65368f58f095

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

exe 1415378411d7d155dd8217cdc7e453dc221219b2432473d110ea65368f58f095

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3112840/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetStartupInfoA KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::FillConsoleOutputCharacterW KERNEL32.dll::ReadConsoleOutputA KERNEL32.dll::GetConsoleAliasesLengthA KERNEL32.dll::GetConsoleSelectionInfo
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::GetFileAttributesW
WIN_BASE_USER_API	Retrieves Account Information	KERNEL32.dll::GetComputerNameA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample