MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1fd76dbda2ed4a1392326b08e706d4b339bff5cf69b4cfd706a10a15fb4753cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1fd76dbda2ed4a1392326b08e706d4b339bff5cf69b4cfd706a10a15fb4753cb
SHA3-384 hash: e54ee5a0b94b191250b6d47459c5d2345b173fb543188fb9c98db4c852ccb54e5f890b457798b18cc5ff3ff4161d6e16
SHA1 hash: 591e8609dbf7a93ac60785b77728eed67f6a9606
MD5 hash: 46c555e1f356b81323120967141c71aa
humanhash: autumn-finch-lima-nineteen
File name:4AD9.tmp.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:229'888 bytes
First seen:2023-05-13 22:43:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 77912b10e01a49ea3bd0881c3ebc6aa8 (1 x Smoke Loader)
ssdeep 1536:WPIAGF7x5VZf8NCxIePD/5bPdXDhJlIxbTILICbpDUq68nmFL3dYQDKbsYCF+L:zDbBf/5JFJuxnILIIpDUqFnkL3aSU
Threatray 25 similar samples on MalwareBazaar
TLSH T150247D9F1BC080F7F8016A748E89EDC0907EB0F51A5D98AB72E1A9F57E517D8821D31E
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 74fcd4d4d4dcdcdc (1 x Smoke Loader)
Reporter JaffaCakes118
Tags:Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
GB GB
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4AD9.tmp.exe
Verdict:
No threats detected
Analysis date:
2023-05-12 11:34:39 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a05e8be7-3cfb-4bda-a880-2e6054759159

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/388963/
Detection(s):
Win.Packed.Neutrinopos-9855644-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm greyware xpack
Link:
https://www.filescan.io/uploads/646012b4e68f9cbce80c3a81/reports/6ae3df8a-5228-403b-afce-802cc322d5eb/overview
Verdict:
Malicious
Labled as:
Trojan.Crypt
Link:
https://www.hybrid-analysis.com/sample/1fd76dbda2ed4a1392326b08e706d4b339bff5cf69b4cfd706a10a15fb4753cb
Malware family:
DanaBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a694536b-86af-4ca9-9ebb-fd81da0d3d76
Result
Threat name:
SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1232641
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Benign windows process drops PE files
Checks if the current machine is a virtual machine (disk enumeration)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1fd76dbda2ed4a1392326b08e706d4b339bff5cf69b4cfd706a10a15fb4753cb/
Threat name:
Win32.Ransomware.GandCrab
Create hunting rule
Status:
Malicious
First seen:
2018-11-05 16:57:33 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
32 of 37 (86.49%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d7lw3pnc5vfbhersnmeoobwuwm4375opng2m7vyguefbl62hkpfq._file
Verdict:
malicious
Similar samples:
15e8c986c4602c61a474b51d250e03d5bb178eabc8c5a82a242c1a0fa2227704
Smoke Loader
278b7b56fbd477d441cc898216fd90c9fa1a84a143b4a2502770c205066a6622
Smoke Loader
44581bf6e5ff2c32f158deb89021353da59522a06f02cd38500cbe59ee0c6e11
Smoke Loader
82613e699c1daaf0a295972f46b6e026dd8aad154dd0f64da0fde2246aa0ae32
Smoke Loader
b535d4dc180f666de891979e5d9d090c27d1eb0f252423c0b1911f1f0b9fc5b2
Smoke Loader
e9bbcfb5d9f42ef0dd75eb435e78d5226087679593893e0c08977694e720cd7a
Smoke Loader
fe2f17c046d35316bc0d7beaca297b1a25d844c96a26ac610194b34c01b212e5
Smoke Loader
+ 15 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor trojan
Link:
https://tria.ge/reports/230513-2ntpmahe82/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: MapViewOfSection
Maps connected drives based on registry
SmokeLoader
Malware Config
C2 Extraction:
https://dollyjonsaw.top/prof/index.php
http://mollikertes.win/prof/index.php
http://mamabahuyiabas.net/prof/index.php
https://fusdertoplerq.top/prof/index.php
https://mollyfishers.cc/prof/index.php
https://masloperukwed.top/prof/index.php
Gathering data
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/1fd76dbda2ed/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1fd76dbda2ed4a1392326b08e706d4b339bff5cf69b4cfd706a10a15fb4753cb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_smokeloader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.smokeloader.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/388963/

Comments