MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1d56c98200907afafa8a54f802c21ed824e1827162fb19d8f73cf8a8bb61b7f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1d56c98200907afafa8a54f802c21ed824e1827162fb19d8f73cf8a8bb61b7f2
SHA3-384 hash: d7ceafb36a2d02358ea2bd0b6e5e4e15932e875e1b883028b20b61334250f9c823c2bdb69573dd0548dd109f6e99f97f
SHA1 hash: b7d7cf699d6a43c631c6b3065e4f50d70e7a8179
MD5 hash: 9cb0f10770d10bb5fe00d502dfa9a754
humanhash: bacon-ten-jupiter-alpha
File name:9cb0f10770d10bb5fe00d502dfa9a754.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:280'576 bytes
First seen:2021-08-24 06:25:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4dcb3c3a3fe5e134dd41266130cc79d2 (6 x RaccoonStealer, 4 x RedLineStealer, 3 x Tofsee)
ssdeep 6144:CYqKb4oEmrj3wwofXBxcuYCKsK6P/ZVD/CUOs7iwpdM7jAk:YKbJEm3gwsagpPxVD6u7JrOMk
Threatray 1'263 similar samples on MalwareBazaar
TLSH T1AA547C30AB91C034E5B712F445BA83BCB93A7AB16B3550CF52E52AED16386E5EC30747
dhash icon ead8a89cc6e68ee0 (43 x RaccoonStealer, 31 x RedLineStealer, 20 x Smoke Loader)
Reporter abuse_ch
Tags:Dofoil exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'247
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9cb0f10770d10bb5fe00d502dfa9a754.exe
Verdict:
No threats detected
Analysis date:
2021-08-24 06:27:22 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/336c10f5-dbe8-4e1e-a49c-ed5b9d40921a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/181738/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Connection attempt
Sending an HTTP POST request
Deleting of the original file
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/69acde2a-a005-42bd-8f3e-debb69a02e89
Result
Threat name:
KPot RedLine SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/837997
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Antivirus detection for URL or domain
Benign windows process drops PE files
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains VNC / remote desktop functionality (version string found)
Creates a thread in another existing process (thread injection)
Creates autostart registry keys with suspicious names
Deletes itself after installation
Detected unpacking (changes PE section rights)
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected KPot
Yara detected RedLine Stealer
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 470428 Sample: 68e408ftUG.exe Startdate: 24/08/2021 Architecture: WINDOWS Score: 100 48 ebanat6977769.com 2->48 50 api.ip.sb 2->50 70 Multi AV Scanner detection for domain / URL 2->70 72 Antivirus detection for URL or domain 2->72 74 Multi AV Scanner detection for submitted file 2->74 76 7 other signatures 2->76 10 68e408ftUG.exe 2->10         started        13 bftraeg 2->13         started        signatures3 process4 signatures5 98 Detected unpacking (changes PE section rights) 10->98 100 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 10->100 102 Maps a DLL or memory area into another process 10->102 104 Creates a thread in another existing process (thread injection) 10->104 15 explorer.exe 5 10->15 injected 106 Multi AV Scanner detection for dropped file 13->106 108 Machine Learning detection for dropped file 13->108 110 Checks if the current machine is a virtual machine (disk enumeration) 13->110 process6 dnsIp7 56 193.142.59.123, 49712, 49722, 49732 HOSTSLICK-GERMANYNL Netherlands 15->56 58 193.142.59.248, 80 HOSTSLICK-GERMANYNL Netherlands 15->58 60 5 other IPs or domains 15->60 40 C:\Users\user\AppData\Roaming\bftraeg, PE32 15->40 dropped 42 C:\Users\user\AppData\Local\Temp\2893.exe, PE32 15->42 dropped 44 C:\Users\user\...\bftraeg:Zone.Identifier, ASCII 15->44 dropped 62 System process connects to network (likely due to code injection or exploit) 15->62 64 Benign windows process drops PE files 15->64 66 Deletes itself after installation 15->66 68 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->68 20 A2CD.exe 2 4 15->20         started        24 2893.exe 15 26 15->24         started        27 860D.exe 3 15->27         started        29 2 other processes 15->29 file8 signatures9 process10 dnsIp11 46 C:\ProgramData\...\33A2E4F0.exe, PE32 20->46 dropped 78 Detected unpacking (changes PE section rights) 20->78 80 Creates autostart registry keys with suspicious names 20->80 31 33A2E4F0.exe 20->31         started        52 185.215.113.29, 49718, 8678 WHOLESALECONNECTIONSNL Portugal 24->52 54 api.ip.sb 24->54 82 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 24->82 84 Machine Learning detection for dropped file 24->84 86 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 24->86 96 2 other signatures 24->96 34 conhost.exe 24->34         started        88 Query firmware table information (likely to detect VMs) 27->88 90 Tries to detect sandboxes and other dynamic analysis tools (window names) 27->90 92 Hides threads from debuggers 27->92 94 Tries to detect sandboxes / dynamic malware analysis system (registry check) 27->94 36 conhost.exe 27->36         started        file12 signatures13 process14 signatures15 112 Detected unpacking (changes PE section rights) 31->112 114 Machine Learning detection for dropped file 31->114 116 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 31->116 38 WerFault.exe 20 3 31->38         started        process16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1d56c98200907afafa8a54f802c21ed824e1827162fb19d8f73cf8a8bb61b7f2/
Threat name:
Win32.Trojan.Fragtor
Create hunting rule
Status:
Malicious
First seen:
2021-08-23 22:46:33 UTC
AV detection:
16 of 43 (37.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dvlmtaqasb5pv6ukkt4afqq63asodatrml5rtwhxht4kro3bw7za._file
Verdict:
suspicious
Similar samples:
3b15547e53d7254ec42974dc5a1d7b72cffd722a41114944b5606a845be7b76d
Smoke Loader
5f8cc8891a363948a514f7d91aa9170a3c9b743b29dbffbe87108c66dd66ff69
Smoke Loader
8a9f3452db181e6a402c1c2b5f4848c657535bf94572a12eee70a57721f9931b
Smoke Loader
8eea00bd7d1db820c7a1b5622119b76944215e5803c2e8b772b9548e9ee91c66
Smoke Loader
959ed9b65f2c1dff0e7f16367b4f8b04dc091350219a80b63d58e50799e58ce3
Smoke Loader
95d9e11ec01f83253ab4bd861de609f52b101c160214612d5ffa615f3c931a7c
Smoke Loader
9d1574036b8d1853c6355e6212c29ffe57e1e0653b65605b0f9664e5d194b2f9
Smoke Loader
dbb1ffb8a8b13b389fd8aff976808226333bc23d8aafc33111b88206f498fcea
Smoke Loader
dfae191d0f324a74e03fe2b99f10a2a33daca3ede5b2f226db8d4905d76414ef
Smoke Loader
+ 1'253 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:redline family:smokeloader backdoor infostealer trojan
Link:
https://tria.ge/reports/210824-dmrvgqpgex/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
Loads dropped DLL
Downloads MZ/PE file
Executes dropped EXE
RedLine
RedLine Payload
SmokeLoader
Malware Config
C2 Extraction:
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
185.215.113.29:8678
Unpacked files
SH256 hash:
18cd8e90fcd46329480f24d43baa489683b3ee2fcd274bf1714947ef307a6ab2
MD5 hash:
f2fecf6872ad4c61a3a506159fddd4fc
SHA1 hash:
28e039eb96dcf58841992280c66433a2bbab8e84
Link:
https://www.unpac.me/results/3116af10-f83b-421e-a8df-84adf815245c/
SH256 hash:
1d56c98200907afafa8a54f802c21ed824e1827162fb19d8f73cf8a8bb61b7f2
MD5 hash:
9cb0f10770d10bb5fe00d502dfa9a754
SHA1 hash:
b7d7cf699d6a43c631c6b3065e4f50d70e7a8179
Link:
https://www.unpac.me/results/3116af10-f83b-421e-a8df-84adf815245c/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/1d56c9820090/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1d56c98200907afafa8a54f802c21ed824e1827162fb19d8f73cf8a8bb61b7f2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 1d56c98200907afafa8a54f802c21ed824e1827162fb19d8f73cf8a8bb61b7f2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1545011/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/181738/

Comments