MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1561d6849d0b3394ab23968ba921e3c9af313ecf90cf2911b64889536c080dd4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1561d6849d0b3394ab23968ba921e3c9af313ecf90cf2911b64889536c080dd4
SHA3-384 hash: 357b6b70e1e75e55bde315eddef8e65ae8a2d0eaa0209509d8cf5b54013761562ef23974d081371a73be0c749f3012d6
SHA1 hash: 69d62752b168646a28d3c24aeceef8adef4bc467
MD5 hash: c52e33ec6bac9c3e148e01e8cf17749e
humanhash: blossom-earth-arizona-network
File name:c52e33ec6bac9c3e148e01e8cf17749e.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:176'640 bytes
First seen:2021-10-12 08:48:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 613eed189326e5150348769c0b41fcc9 (3 x RedLineStealer, 3 x Smoke Loader)
ssdeep 3072:TQiJ5o2Bf05zaTMYxA/VxIbNkquIKCw2XsoS9D98aShyuy50WhcaS2Eue3E:TrjHBfQ2/xA/VSmNY8Vx98aC+0WhkcyE
Threatray 2'146 similar samples on MalwareBazaar
TLSH T11404BF1071E0C476D59617728CB58FE69A7BB9710BF481CB7BEC362F2E603C06A2535A
File icon (PE):PE icon
dhash icon 81bcdcac9cccb48c (4 x RaccoonStealer, 3 x Smoke Loader, 3 x RedLineStealer)
Reporter abuse_ch
Tags:Dofoil exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
186
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5545c43eb14b0519ab997673efa379343f98d2b6b1578d9fdeb369234789f9dd
Verdict:
Malicious activity
Analysis date:
2021-10-12 06:10:02 UTC
Tags:
evasion trojan loader opendir stealer vidar rat redline
Link:
https://app.any.run/tasks/4e5cac8c-d368-4330-9466-89be55b224b3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/196834/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader43.42506.10786.15087.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f54a2913-8afb-495c-a18e-54305f46773f
Result
Threat name:
Raccoon RedLine SmokeLoader Tofsee Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/868493
Signature
Antivirus detection for URL or domain
Benign windows process drops PE files
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to steal Internet Explorer form passwords
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the windows firewall
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Sigma detected: Copying Sensitive Files with Credential Data
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses netsh to modify the Windows network and firewall settings
Yara detected Costura Assembly Loader
Yara detected Raccoon Stealer
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Tofsee
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 500928 Sample: iwTiB0dgnZ.exe Startdate: 12/10/2021 Architecture: WINDOWS Score: 100 61 185.215.113.75 WHOLESALECONNECTIONSNL Portugal 2->61 63 microsoft-com.mail.protection.outlook.com 52.101.24.0, 25, 49836 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 2->63 65 9 other IPs or domains 2->65 81 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->81 83 Multi AV Scanner detection for domain / URL 2->83 85 Antivirus detection for URL or domain 2->85 87 17 other signatures 2->87 10 iwTiB0dgnZ.exe 2->10         started        13 svchost.exe 1 2->13         started        15 svchost.exe 1 2->15         started        17 3 other processes 2->17 signatures3 process4 signatures5 113 Detected unpacking (changes PE section rights) 10->113 19 iwTiB0dgnZ.exe 10->19         started        process6 signatures7 89 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 19->89 91 Maps a DLL or memory area into another process 19->91 93 Checks if the current machine is a virtual machine (disk enumeration) 19->93 95 Creates a thread in another existing process (thread injection) 19->95 22 explorer.exe 20 19->22 injected process8 dnsIp9 67 192.162.246.70, 49794, 80 DATACHEAP-LLC-ASRU Russian Federation 22->67 69 iselaharty12.club 91.224.22.228, 49775, 49777, 49778 AS-REGRU Russian Federation 22->69 71 3 other IPs or domains 22->71 43 C:\Users\user\AppData\Roaming\bsfsjbj, PE32 22->43 dropped 45 C:\Users\user\AppData\Local\Temp\D5FD.exe, PE32 22->45 dropped 47 C:\Users\user\AppData\Local\Temp\CA44.exe, PE32 22->47 dropped 49 8 other files (4 malicious) 22->49 dropped 97 System process connects to network (likely due to code injection or exploit) 22->97 99 Benign windows process drops PE files 22->99 101 Deletes itself after installation 22->101 103 Hides that the sample has been downloaded from the Internet (zone.identifier) 22->103 27 D5FD.exe 80 22->27         started        32 CA44.exe 3 22->32         started        34 AAF2.exe 22->34         started        36 BD91.exe 2 22->36         started        file10 signatures11 process12 dnsIp13 73 5.181.156.229, 49822, 80 MIVOCLOUDMD Moldova Republic of 27->73 75 tgmirror.top 104.21.61.215, 49817, 49818, 80 CLOUDFLARENETUS United States 27->75 79 2 other IPs or domains 27->79 51 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 27->51 dropped 53 C:\Users\user\AppData\...\vcruntime140.dll, PE32 27->53 dropped 55 C:\Users\user\AppData\...\ucrtbase.dll, PE32 27->55 dropped 59 56 other files (none is malicious) 27->59 dropped 115 Detected unpacking (changes PE section rights) 27->115 117 Detected unpacking (overwrites its own PE header) 27->117 119 Tries to steal Mail credentials (via file access) 27->119 133 2 other signatures 27->133 77 45.9.20.149 DEDIPATH-LLCUS Russian Federation 32->77 121 Query firmware table information (likely to detect VMs) 32->121 123 Tries to detect sandboxes and other dynamic analysis tools (window names) 32->123 125 Hides threads from debuggers 32->125 127 Tries to detect sandboxes / dynamic malware analysis system (registry check) 32->127 38 conhost.exe 32->38         started        40 AAF2.exe 34->40         started        57 C:\Users\user\AppData\Local\...\creamleq.exe, PE32 36->57 dropped 129 Uses netsh to modify the Windows network and firewall settings 36->129 131 Modifies the windows firewall 36->131 file14 signatures15 process16 signatures17 105 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 40->105 107 Maps a DLL or memory area into another process 40->107 109 Checks if the current machine is a virtual machine (disk enumeration) 40->109 111 Creates a thread in another existing process (thread injection) 40->111
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1561d6849d0b3394ab23968ba921e3c9af313ecf90cf2911b64889536c080dd4/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=cvq5nbe5bmzzjkzds2f2sipdzgxtcpwpsdhssenwjcevg3aibxka._file
Verdict:
malicious
Similar samples:
323a27a7f2a664921d46c965f0c8d5977fb6c8fce20ba04e208c2945b7abdbba
Smoke Loader
49ad4fd1bd40286214edaee6edfa7ce8915b6bbd39758a4a93175f48626a478b
Smoke Loader
4eb02a90be27af84c49a2f62da8e179e5117d82db4e25c7a2c80e2954583bdb3
Smoke Loader
63f6a92084e81e72720f6160287e6766e2214f489d11142a9668925c6c4616f2
Smoke Loader
8694a45a295efd9a5114eca3c41fd4338e6ba029f497be4f66035ebf375cbd38
Smoke Loader
8b59d8f1ea4fb412eb2064b4243c6f2dcc4efd26b78e3eae92c9daf6f6a70b7b
Smoke Loader
9535b07e3af3a051c0de3169f11aed4e5f7dd52d651e739f16db250bc631def5
Smoke Loader
9bec2f9c52d746d49dffd22fc0cf217c87970b85d7fb4e19e908edc0eb48c16a
Smoke Loader
bd48e5cc58403ce89b10efaed95592ac5ebfe08167640f6f92434ff73e16cc8e
Smoke Loader
d6d09e51d2e7eb9f29b4ee44530696f893ba14a7c1d119cb8f1e41cd7861eaa6
Smoke Loader
+ 2'136 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:arkei family:raccoon family:redline family:smokeloader family:tofsee family:vidar family:xmrig botnet:1033 botnet:159 botnet:fbe5e97e7d069407605ee9138022aa82166657e6 backdoor discovery evasion infostealer miner persistence spyware stealer themida trojan vmprotect
Link:
https://tria.ge/reports/211012-kq132sbhg5/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Kills process with taskkill
Modifies data under HKEY_USERS
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Launches sc.exe
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
Checks BIOS information in registry
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
Creates new service(s)
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
Sets service image path in registry
VMProtect packed file
Arkei Stealer Payload
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Vidar Stealer
XMRig Miner Payload
Arkei
Raccoon
RedLine
RedLine Payload
SmokeLoader
Suspicious use of NtCreateProcessExOtherParentProcess
Tofsee
Vidar
Windows security bypass
xmrig
Malware Config
C2 Extraction:
http://linavanandr11.club/
http://iselaharty12.club/
http://giovaninardo13.club/
http://zayneliann14.club/
http://zorinosali15.club/
defeatwax.ru
refabyd.info
190.2.136.29:3279
https://mas.to/@oleg98
Unpacked files
SH256 hash:
44d561fa45b325317126cacc8ebdb223235f76b34e0ed76dd50e7b0710d62a8d
MD5 hash:
f41ebae062405a696d868198d645f6d6
SHA1 hash:
17dac108dc94c7493289ff6a53fb96b3682af20a
Link:
https://www.unpac.me/results/816966a0-2513-4094-992e-503dfdf5a9c2/
SH256 hash:
1561d6849d0b3394ab23968ba921e3c9af313ecf90cf2911b64889536c080dd4
MD5 hash:
c52e33ec6bac9c3e148e01e8cf17749e
SHA1 hash:
69d62752b168646a28d3c24aeceef8adef4bc467
Link:
https://www.unpac.me/results/816966a0-2513-4094-992e-503dfdf5a9c2/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/1561d6849d0b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1561d6849d0b3394ab23968ba921e3c9af313ecf90cf2911b64889536c080dd4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 1561d6849d0b3394ab23968ba921e3c9af313ecf90cf2911b64889536c080dd4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1660824/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/196834/

Comments