MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 24471f2fd20e7386aa533b51bf851cdeb9ee0750a615273c6004b86e463d36d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 16


Intelligence 16 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 24471f2fd20e7386aa533b51bf851cdeb9ee0750a615273c6004b86e463d36d2
SHA3-384 hash: d4ac05ecf2637af609b758322f3c69eca3ab5324026841ebb83acb625689117683b14d1eaa7181cc05bbddc4083623fb
SHA1 hash: 9a92f4b46c4e6cb97ed12807cebea65a6fc101bf
MD5 hash: 68bc4ce7b6c15f1f5a40e361b2214fce
humanhash: lion-johnny-oscar-crazy
File name:68bc4ce7b6c15f1f5a40e361b2214fce.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:270'848 bytes
First seen:2023-05-05 11:47:54 UTC
Last seen:2023-05-13 22:55:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 2d39bee49f300ea90fe79768115a52cd (3 x Smoke Loader, 1 x Rhadamanthys, 1 x Stop)
ssdeep 3072:2Zy2GFBozzDTnboBgWB9hgH0m1gtrkBrAX3b7991tXzY220rN0bN4rdYE0/p:Dxw/Xnb4gcwUgGrkKX371Jr+mdx0h
Threatray 703 similar samples on MalwareBazaar
TLSH T140447D1272E1A875F636CA324E6AC6F4661FFC518F557BEF13046A2F09711E2C572322
TrID 39.5% (.EXE) InstallShield setup (43053/19/16)
28.6% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
9.6% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon 00206088c4632100 (1 x Smoke Loader)
Reporter abuse_ch
Tags:Dofoil exe Smoke Loader

Intelligence

File Origin
# of uploads :
4
# of downloads :
224
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
smoke
Create hunting rule
ID:
1
File name:
68bc4ce7b6c15f1f5a40e361b2214fce.exe
Verdict:
Malicious activity
Analysis date:
2023-05-05 11:49:17 UTC
Tags:
installer loader smoke trojan stealer
Link:
https://app.any.run/tasks/b4903bf9-0d64-4cae-8ee4-915b4557de37

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
SmokeLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/386836/
Detection(s):
Win.Dropper.Tofsee-10000280-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for synchronization primitives
Sending a custom TCP request
Reading critical registry keys
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Sending an HTTP POST request
Launching a process
Creating a file in the %temp% directory
Launching the default Windows debugger (dwwin.exe)
Unauthorized injection to a system process
Enabling autorun by creating a file
Forced shutdown of a browser
Unauthorized injection to a browser process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/6454ecf96cb75a144089d9c9/reports/e6933f2d-3cbd-4503-a8a3-a87272852abf/overview
Verdict:
Malicious
Labled as:
Babar.Generic
Link:
https://www.hybrid-analysis.com/sample/24471f2fd20e7386aa533b51bf851cdeb9ee0750a615273c6004b86e463d36d2
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4ac457fc-fca3-4934-8182-c2ff0fc34d88
Result
Threat name:
SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
bank.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1226854
Signature
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if browser processes are running
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to compare user and computer (likely to detect sandboxes)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Found evasive API chain (may stop execution after checking mutex)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 859819 Sample: 3zI46st6lx.exe Startdate: 05/05/2023 Architecture: WINDOWS Score: 100 35 Snort IDS alert for network traffic 2->35 37 Found malware configuration 2->37 39 Malicious sample detected (through community Yara rule) 2->39 41 5 other signatures 2->41 8 3zI46st6lx.exe 2->8         started        11 fviiuav 2->11         started        process3 signatures4 53 Detected unpacking (changes PE section rights) 8->53 55 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 8->55 57 Maps a DLL or memory area into another process 8->57 59 Creates a thread in another existing process (thread injection) 8->59 13 explorer.exe 2 4 8->13 injected 61 Multi AV Scanner detection for dropped file 11->61 63 Machine Learning detection for dropped file 11->63 65 Checks if the current machine is a virtual machine (disk enumeration) 11->65 process5 dnsIp6 33 coudzoom.ru 193.106.175.177, 49728, 80 IQHOSTRU Russian Federation 13->33 29 C:\Users\user\AppData\Roaming\fviiuav, PE32 13->29 dropped 31 C:\Users\user\...\fviiuav:Zone.Identifier, ASCII 13->31 dropped 67 System process connects to network (likely due to code injection or exploit) 13->67 69 Benign windows process drops PE files 13->69 71 Injects code into the Windows Explorer (explorer.exe) 13->71 73 3 other signatures 13->73 18 explorer.exe 6 13->18         started        21 explorer.exe 13->21         started        23 explorer.exe 13->23         started        25 13 other processes 13->25 file7 signatures8 process9 signatures10 43 Found evasive API chain (may stop execution after checking mutex) 18->43 45 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 18->45 47 Tries to steal Mail credentials (via file / registry access) 18->47 51 2 other signatures 18->51 49 Tries to harvest and steal browser information (history, passwords, etc) 21->49 27 WerFault.exe 3 10 23->27         started        process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/24471f2fd20e7386aa533b51bf851cdeb9ee0750a615273c6004b86e463d36d2/
Threat name:
Win32.Trojan.RhadamanthysStealer
Create hunting rule
Status:
Malicious
First seen:
2023-05-04 11:32:57 UTC
File Type:
PE (Exe)
Extracted files:
60
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=erdr6l6sbzzynksthni37bi432464b2quyksopdaas4g4rr5g3ja._file
Verdict:
malicious
Similar samples:
08f5ac47b3775e23096ed6113a609fd46971e2f3ffc9d97c7f28a93fa446987c
Smoke Loader
0baa53972ce2be403f9e5d9d3a7f5d7098858a3acd9e16a315f6e4f5e0b2c902
Smoke Loader
253c30cb71da9048557691a67f05e87c83c103c691b27e17674805eb0aa08aed
Smoke Loader
2ad9af4d99a267b9999bf64ae074415083055d48381a60556d38265c2a167c49
Smoke Loader
4dc27dc6049bc102a6dd9ea4c12cc26a31d53655d702ee69a001d794e8008e2e
Smoke Loader
63245db706967913668434367fc543daa9e7b81b05519c9f50ddca6c274daaae
Smoke Loader
dc0af5683ce510948ca084132a0fa0eda830021d744a8b8663800df28551babb
Smoke Loader
e9536c08cffb2ce78225bb133a4c2315e6516620ec671afbcea66fcc690efd8e
Smoke Loader
f2e22cf5c74647781bc9087e562edcb87e9e4d19c89387deb068b65d23489ef1
Smoke Loader
+ 693 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor trojan
Link:
https://tria.ge/reports/230505-nyfzmaaa95/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Uses Task Scheduler COM API
Executes dropped EXE
SmokeLoader
Malware Config
C2 Extraction:
http://coudzoom.ru/
http://balkimotion.ru/
http://ligaspace.ru/
http://ipodromlan.ru/
http://redport80.ru/
http://superboler.com/
http://lamazone.site/
http://criticalosl.tech/
http://3dstore.pro/
http://humanitarydp.ug/
http://shopersport.ru/
http://sindoproperty.org/
http://maximprofile.net/
http://zaliphone.com/
Unpacked files
SH256 hash:
7ee1ab4270a5293e7151a6321ce17962022802f72a7d58c264e43a016a8a49a4
MD5 hash:
185efba2b3bf87e7d49a05ebb0ad5114
SHA1 hash:
0d9f24973c2c7d262d54e8c34a3ff33c71862372
Detections:
SmokeLoaderStage2
Create hunting rule
win_smokeloader_a2
Create hunting rule
Link:
https://www.unpac.me/results/9d7ddaf6-5ba0-4a62-aaaa-0eadac98bade/
Parent samples :
24471f2fd20e7386aa533b51bf851cdeb9ee0750a615273c6004b86e463d36d2
cd0226a2b9c38ab99f2bbe4461b7fc9d4b07faafbe1ccc53d92bf08d1903a8ae
ae74817df2569f0619a180f569caf62d7ac5d5418f7a64cb4e21724f20d96dd6
SH256 hash:
24471f2fd20e7386aa533b51bf851cdeb9ee0750a615273c6004b86e463d36d2
MD5 hash:
68bc4ce7b6c15f1f5a40e361b2214fce
SHA1 hash:
9a92f4b46c4e6cb97ed12807cebea65a6fc101bf
Link:
https://www.unpac.me/results/9d7ddaf6-5ba0-4a62-aaaa-0eadac98bade/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/24471f2fd20e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/24471f2fd20e7386aa533b51bf851cdeb9ee0750a615273c6004b86e463d36d2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/386836/

Comments