MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 249892379b83b72370cd08275f4a9e780a5ad223c17b4032ba80ee0f3fbce76d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 249892379b83b72370cd08275f4a9e780a5ad223c17b4032ba80ee0f3fbce76d
SHA3-384 hash: c1cb39c517b86efa57e1e556eab9612a78763f1cb6c3a4695b1fdf393cefc3406d857b32e1a80ecaac8c420ecdcc20c5
SHA1 hash: 08061fa5a8617203538c0586137548e15f82c7c5
MD5 hash: a280b24ed3b4add6700652d7dcf95337
humanhash: muppet-idaho-jersey-spring
File name:a280b24ed3b4add6700652d7dcf95337.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:33'280 bytes
First seen:2021-02-01 18:17:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 768:FrqQ7AmV3rjBkyo1bXkA8K9CWdiwtwTxf+/ASDz30UYlyvQhth:F33k7j8JFfwAbDxz
Threatray 789 similar samples on MalwareBazaar
TLSH 65E2D07A6A947DF5C1724A38CACE8CED4AF941492430C22C5FB9F8CEED570C52D25197
Reporter abuse_ch
Tags:Dofoil exe Smoke Loader


Avatar
abuse_ch
Smoke Loader C2:
http://ball00ns.com/1/

Intelligence

File Origin
# of uploads :
1
# of downloads :
496
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9a5e1efc29e092f22a1c18a8940f936095c8140488593aaa81a353855ce46593
Verdict:
Malicious activity
Analysis date:
2020-12-08 11:19:10 UTC
Tags:
exploit CVE-2017-11882 loader smoke trojan
Link:
https://app.any.run/tasks/f8d801b0-fdd4-4851-8100-b2113b22da1e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/115009/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Sending a UDP request
Sending an HTTP GET request
Creating a file in the %AppData% subdirectories
Enabling the 'hidden' option for recently created files
DNS request
Connection attempt
Sending an HTTP POST request
Deleting of the original file
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/595747
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Benign windows process drops PE files
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/249892379b83b72370cd08275f4a9e780a5ad223c17b4032ba80ee0f3fbce76d/
Threat name:
Win32.Trojan.Zurgop
Create hunting rule
Status:
Malicious
First seen:
2020-11-09 01:48:54 UTC
AV detection:
25 of 27 (92.59%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=esmjen43qo3sg4gnbatv6su6paffvurdyf5uamv2qdxa6p5445wq._file
Verdict:
malicious
Similar samples:
028115ae3e6e3fc774f58184b4bb7d257f626ce5cf6a60e1a749c22fe74803f2
Smoke Loader
05d99ea508e2cdb90354fd76cc1807fcf1cfd533bc3652eb7bfbb93ec701994e
Smoke Loader
48b12450184f77c6a5a0f24b05cbb4c275145e3abe8ab91c601af2587de8bd08
Smoke Loader
5c019c670f05ca8797454be6c73de265381e5fd9fc7ef921263e3f982c8004a5
Smoke Loader
62b720cfb1c69f4b21f4bd55c8e7fa1cfd71da081db1afbbed005dfc010c9bfb
Smoke Loader
96e4ab3ae8f4486ee0bab405d20c7e00b886072257e8b089ed2dccb39032bcee
Smoke Loader
b1cd81ef90363936ef04a6d5cabb539bbc4a89a25b6baf6777e1a3e373455f40
Smoke Loader
b9b9457414995a44d73a5f9e4f2e4487adb8334fac4acc3ea1b529a5a648cbe4
Smoke Loader
c12927e94316183af8da2f28a16b715ba98a8f33ef846f0290434cf7ef0fdc2b
Smoke Loader
cb663a4fa79cb0fcb52c3049b65b1a012c45e72badc13c931fc2c72a8a94dcca
Smoke Loader
+ 779 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor trojan
Link:
https://tria.ge/reports/210201-j3xqlmmm6e/
Behaviour
Suspicious behavior: MapViewOfSection
Maps connected drives based on registry
SmokeLoader
Malware Config
C2 Extraction:
http://ball00ns.com/1/
Unpacked files
SH256 hash:
249892379b83b72370cd08275f4a9e780a5ad223c17b4032ba80ee0f3fbce76d
MD5 hash:
a280b24ed3b4add6700652d7dcf95337
SHA1 hash:
08061fa5a8617203538c0586137548e15f82c7c5
Detections:
win_smokeloader_auto
Create hunting rule
Link:
https://www.unpac.me/results/c5c6841f-7816-4626-8c19-22021771872b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Smokeloader
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/249892379b83b72370cd08275f4a9e780a5ad223c17b4032ba80ee0f3fbce76d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_smokeloader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 249892379b83b72370cd08275f4a9e780a5ad223c17b4032ba80ee0f3fbce76d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/986071/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/115009/

Comments