MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 161da33d9550b2e9c838abc55513091a070af910a882eab015fd2a5f96e025f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 11

Intelligence 11 IOCs YARA File information Comments

SHA256 hash:	161da33d9550b2e9c838abc55513091a070af910a882eab015fd2a5f96e025f3
SHA3-384 hash:	7cc49fb347e545ae154fe6adcc5d05487ad9b6e65e6c9203fc31d6f093ae89579b7fe14f912f59468710cbd67a7799cf
SHA1 hash:	11e15910c0a4189865bd7f02a63c9913917e9b65
MD5 hash:	0bd5e458f76279c6327e38ec17406407
humanhash:	asparagus-snake-mountain-eleven
File name:	0bd5e458f76279c6327e38ec17406407.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	278'528 bytes
First seen:	2022-03-28 08:20:09 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4dfbd068d509e65cfeadeb4a32c65fed (2 x Smoke Loader, 1 x Stop)
ssdeep	3072:ERN10JqcK4yunhv/h/olgInljShFi+VYjpEB7dS5OYBrs0reCv2l:ELgOehv5/ol/EFHYCb+rDqC+
Threatray	4'172 similar samples on MalwareBazaar
TLSH	T1F544BD233581C432E52222B56856C7B59BABB8311A359A8F3F94126C9F353E3DF76307
File icon (PE):
dhash icon	5c599a3ce0c3c850 (43 x Stop, 37 x RedLineStealer, 36 x Smoke Loader)
Reporter	abuse_ch
Tags:	exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

208

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/258512/

Detection(s):

Win.Packed.Strab-9942213-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Sending an HTTP POST request

Sending a custom TCP request

Sending an HTTP GET request

Enabling autorun by creating a file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/11766/overview

Behaviour

MeasuringTime

SystemUptime

CheckCmdLine

EvasionQueryPerformanceCounter

EvasionGetTickCount

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware lockbit

Link:

https://www.filescan.io/uploads/62416ff19253b276b78d8f66/reports/929949ac-7007-4ab3-9b3f-38cc28ab3c71/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

STOP Ransomware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/2235c498-6a6b-4694-841b-0a5412d1520b

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/965618

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to evade debugger and weak emulator (self modifying code)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/161da33d9550b2e9c838abc55513091a070af910a882eab015fd2a5f96e025f3/

Threat name:

Win32.Trojan.Raccrypt

Status:

Malicious

First seen:

2022-03-27 17:29:00 UTC

AV detection:

22 of 26 (84.62%)

Threat level:

5/5

Verdict:

malicious

Smoke Loader

995cce8a3847b995d70f0d3148b782a3cdbc2b1297925dcb654bec2504bcf946

Smoke Loader

a820caf880ba4cb81e50891feb62ff304e0322a31141b11f3813fc477e2044e6

Smoke Loader

d796df8e7ea24a1076fcb5ec457e0b0c14219905fd34bf8d8761a6d2b1c546f9

Smoke Loader

d941de99b4f1c476c39a4d5679f945710161d76e3920dbca3000b7fa83870d0e

Smoke Loader

ebf3a044246492128aa29dad0c4802f374fe32efb8179da5b9f284dc7e3579a4

Smoke Loader

f7b3c3137aa931a3ec93978f41edb88499f236f9759208e74fedf6a671c748c5

Smoke Loader

+ 4'162 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor trojan

Link:

https://tria.ge/reports/220328-j8zr9sddbn/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Deletes itself

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

SmokeLoader

Malware Config

C2 Extraction:

http://coralee.at/upload/
http://ducvietcao.com/upload/
http://biz-acc.ru/upload/
http://toimap.com/upload/
http://bbb7d.com/upload/
http://piratia-life.ru/upload/
http://curvreport.com/upload/
http://viagratos.com/upload/
http://mordo.ru/upload/
http://pkodev.net/upload/