MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 256549e1aca2c0b056b2fc5304bdd480b95d2ad278678707c87ad27f6aa31eb0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 256549e1aca2c0b056b2fc5304bdd480b95d2ad278678707c87ad27f6aa31eb0
SHA3-384 hash: 10b2d1afcc521f1ad36e75624a73da62c4582c1416c9029bea3c9e2a453f79606481bcb5efc5978b25185295175bdf42
SHA1 hash: 48549496f895d4c629da6bf61473c477e868d329
MD5 hash: ccdf7bb402c102d54ffa82062612182d
humanhash: music-oranges-march-leopard
File name:ccdf7bb402c102d54ffa82062612182d.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:144'384 bytes
First seen:2021-11-19 08:36:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 702a7c8c628781977ea801fc66976f12 (3 x RedLineStealer, 2 x ArkeiStealer, 1 x Smoke Loader)
ssdeep 3072:97n4lj0iP6r9wMZm3Q8b3hHm2SWYFcHProw+HYeX2RrCB:piP6r9wBg8bdcWYFcHPrvT
Threatray 101 similar samples on MalwareBazaar
TLSH T12DE38DD07FE18433E1A39532697086A1CA2BBC72F675B94B2354C21E1E712D0FEA5763
File icon (PE):PE icon
dhash icon fcfcd4f4d4d4d8c0 (23 x RedLineStealer, 21 x RaccoonStealer, 6 x Smoke Loader)
Reporter abuse_ch
Tags:exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
125
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ccdf7bb402c102d54ffa82062612182d.exe
Verdict:
No threats detected
Analysis date:
2021-11-19 09:20:47 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/68ff5cb8-578e-420e-aa60-f333aa16871a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Detection(s):
Win.Packed.Generic-9908949-0
Create hunting rule

Win.Dropper.Fragtor-9909325-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Sending an HTTP POST request
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/6197623243e8f62b669a1aea/reports/0b3a026e-e536-4948-bf62-0033848bb1b8/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b716417f-80da-41c5-9fcb-d8b4d8f70ea4
Result
Threat name:
Clipboard Hijacker Raccoon RedLine Smoke
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/892551
Signature
.NET source code contains method to dynamically call methods (often used by packers)
Antivirus detection for URL or domain
Benign windows process drops PE files
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to infect the boot sector
Creates a thread in another existing process (thread injection)
Delayed program exit found
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
DLL reload attack detected
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Renames NTDLL to bypass HIPS
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Clipboard Hijacker
Yara detected Raccoon Stealer
Yara detected RedLine Stealer
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 525022 Sample: vPGGPcSfZg.exe Startdate: 19/11/2021 Architecture: WINDOWS Score: 100 52 91.219.236.162, 80 SERVERASTRA-ASHU Hungary 2->52 54 rsuehfidvdkfvk.top 2->54 56 gululugu.zzz.com.ua 2->56 66 Multi AV Scanner detection for domain / URL 2->66 68 Antivirus detection for URL or domain 2->68 70 Multi AV Scanner detection for submitted file 2->70 72 14 other signatures 2->72 9 vPGGPcSfZg.exe 2->9         started        12 wvsecdr 2->12         started        14 evsecdr 2->14         started        16 2 other processes 2->16 signatures3 process4 signatures5 110 Detected unpacking (changes PE section rights) 9->110 112 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 9->112 114 Maps a DLL or memory area into another process 9->114 18 explorer.exe 6 9->18 injected 116 Multi AV Scanner detection for dropped file 12->116 118 Machine Learning detection for dropped file 12->118 120 Checks if the current machine is a virtual machine (disk enumeration) 12->120 122 Creates a thread in another existing process (thread injection) 14->122 process6 dnsIp7 58 189.165.53.172, 49877, 80 UninetSAdeCVMX Mexico 18->58 60 petknorra.com 95.213.216.152, 49792, 49822, 80 SELECTELRU Russian Federation 18->60 62 9 other IPs or domains 18->62 42 C:\Users\user\AppData\Roaming\wvsecdr, PE32 18->42 dropped 44 C:\Users\user\AppData\Roaming\evsecdr, PE32 18->44 dropped 46 C:\Users\user\AppData\Local\Temp\B3B2.exe, PE32 18->46 dropped 48 8 other malicious files 18->48 dropped 82 System process connects to network (likely due to code injection or exploit) 18->82 84 Benign windows process drops PE files 18->84 86 Deletes itself after installation 18->86 88 Hides that the sample has been downloaded from the Internet (zone.identifier) 18->88 23 83D1.exe 3 18->23         started        26 628C.exe 18->26         started        28 5D73.exe 4 18->28         started        31 4 other processes 18->31 file8 signatures9 process10 dnsIp11 90 DLL reload attack detected 23->90 92 Machine Learning detection for dropped file 23->92 34 83D1.exe 23->34         started        94 Detected unpacking (changes PE section rights) 26->94 96 Maps a DLL or memory area into another process 26->96 98 Checks if the current machine is a virtual machine (disk enumeration) 26->98 100 Creates a thread in another existing process (thread injection) 26->100 50 C:\Users\user\AppData\...\SmartClock.exe, PE32 28->50 dropped 102 Detected unpacking (overwrites its own PE header) 28->102 104 Delayed program exit found 28->104 38 SmartClock.exe 28->38         started        64 185.215.113.29, 1102, 49869 WHOLESALECONNECTIONSNL Portugal 31->64 106 Multi AV Scanner detection for dropped file 31->106 108 Contains functionality to infect the boot sector 31->108 file12 signatures13 process14 file15 40 C:\Users\user\AppData\Local\Temp\4C05.tmp, PE32 34->40 dropped 74 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 34->74 76 Renames NTDLL to bypass HIPS 34->76 78 Maps a DLL or memory area into another process 34->78 80 2 other signatures 34->80 signatures16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/256549e1aca2c0b056b2fc5304bdd480b95d2ad278678707c87ad27f6aa31eb0/
Threat name:
Win32.Ransomware.Stop
Create hunting rule
Status:
Malicious
First seen:
2021-11-19 07:18:04 UTC
AV detection:
24 of 44 (54.55%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
305c0c524645f5fdebb135076c3c4411a03102c518385852860ea2120093c5f8
Smoke Loader
946f111acee62af04c9b67628cc68a4630f1a0c0f70240f7d89821deeafe85cf
Smoke Loader
a6c90b4cf3dac72a1cf401cd8995b5e8a7e11b38efb76ba1c06af7867683d76d
Smoke Loader
a9feed41ad2265e4c8a14047a8e95fa634b0ce8a99f7fad810b3294dd5720e7f
Smoke Loader
b05798eab2bd214db04037519c3d5271e9602980123b594c8b579f5581d4efdd
Smoke Loader
dee95532f15e2ec01276b45a5cec1eddc591ea64ce8104addaab693af4e0651e
Smoke Loader
eac7ad1a557e26c8be44b8d3f223a764b07f346f8f7037df3614be67edeb644b
Smoke Loader
f6c10cababdca8d6de20f8977489182b31ce24bb2ac9399965d32cedf0f526fe
Smoke Loader
+ 91 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor trojan
Link:
https://tria.ge/reports/211119-kh522acgg4/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Deletes itself
Drops startup file
Loads dropped DLL
Downloads MZ/PE file
Executes dropped EXE
SmokeLoader
Malware Config
C2 Extraction:
http://membro.at/upload/
http://jeevanpunetha.com/upload/
http://misipu.cn/upload/
http://zavodooo.ru/upload/
http://targiko.ru/upload/
http://vues3d.com/upload/
Unpacked files
SH256 hash:
38b50520397a48d6dc0044fb2aca06b6789cfbe921488422471eab7def65e820
MD5 hash:
67c9034e01a3a23f977b8aa138e88b57
SHA1 hash:
e430b48053c15d914edc1eca59be4964292648c2
Link:
https://www.unpac.me/results/87028e30-704e-40cb-8a1c-5f56d63d1f8d/
SH256 hash:
256549e1aca2c0b056b2fc5304bdd480b95d2ad278678707c87ad27f6aa31eb0
MD5 hash:
ccdf7bb402c102d54ffa82062612182d
SHA1 hash:
48549496f895d4c629da6bf61473c477e868d329
Link:
https://www.unpac.me/results/87028e30-704e-40cb-8a1c-5f56d63d1f8d/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/256549e1aca2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/256549e1aca2c0b056b2fc5304bdd480b95d2ad278678707c87ad27f6aa31eb0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 256549e1aca2c0b056b2fc5304bdd480b95d2ad278678707c87ad27f6aa31eb0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1799142/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/207546/

Comments