MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c10f6776795d59fe038ed6b7ff9e2d1a710a027a35845e34e4cd5fef17892f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	2c10f6776795d59fe038ed6b7ff9e2d1a710a027a35845e34e4cd5fef17892f8
SHA3-384 hash:	5bdbba03118e2e1c1e3774477169ffb17e8530a93cdb1dfb6bd451f92ef0362a04562e730343d76c8b039dbefd2a093a
SHA1 hash:	08d639b601a5360dd094bdbc2fd6bbbddbdf3da0
MD5 hash:	30abc4ac02c157bc0872f2c8659c5d37
humanhash:	angel-venus-july-skylark
File name:	30abc4ac02c157bc0872f2c8659c5d37.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	287'232 bytes
First seen:	2020-11-11 11:49:58 UTC
Last seen:	2020-11-11 13:51:08 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	c25051ab6f9bde4873ea577d64187971 (8 x Smoke Loader)
ssdeep	3072:cKKmhfPhNeLJyEq51xU5dkU9s5sI/luBA2It1wtx7PTiCN04uO:cBWfPhELQ5vnUGNuBA2U1wtZiw0c
Threatray	102 similar samples on MalwareBazaar
TLSH	8754BF2176A0D0F3D4A75D304434E6A09AFAB83217744ACB3764A72A5F343F16A7E35B
Reporter	abuse_ch
Tags:	exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

121

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Variant.Babar.23131.7223.31708.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Deleting of the original file

Enabling autorun by creating a file

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/530151

Signature

Benign windows process drops PE files

Binary contains a suspicious time stamp

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Renames NTDLL to bypass HIPS

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2c10f6776795d59fe038ed6b7ff9e2d1a710a027a35845e34e4cd5fef17892f8/

Threat name:

Win32.Trojan.Glupteba

Status:

Malicious

First seen:

2020-11-11 11:55:40 UTC

AV detection:

26 of 29 (89.66%)

Threat level:

5/5

Verdict:

suspicious

Smoke Loader

237097d56dbe6e685d11f86815a8fa3a5e51b1f48e80a9f7e51d1cfabe0ae4aa

Smoke Loader

5acec93c640ee499d02f78f646af7cf65605a56fc20add62c4dabdb402943114

Smoke Loader

7c9eba57cb8262a908dc10929cf38b8e4e0af9f5a3f69bdf226b151761580e91

Smoke Loader

860ce43cef0bbd5b0447f02c55a6c0827aa09e3b7d537b1167bd67047980ab93

Smoke Loader

95a4cf409c7e7813bfa744598bee2e0e572b2d05ec31622867237ea6dab8a813

Smoke Loader

d95b7c505dbb3905f88c71bb1efedfe716a0d65862a622eb932f3d774a07a740

Smoke Loader

e237d6e3b44c0bcacf4eff59f58c8028a48c0675f283adc96490ae6daf645bd7

Smoke Loader

f43fa7b7115450b5a3b8b97c6f578afe6c55692a06d1f872415d547c570da288

Smoke Loader

f85b4fcd61a36635fe0e40af704b607ab33afdc97131c14fd958f6ae101ad1da

Smoke Loader

+ 92 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor trojan

Link:

https://tria.ge/reports/201111-effm8a2fx2/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of UnmapMainImage

Deletes itself

Loads dropped DLL

SmokeLoader

Malware Config

C2 Extraction:

http://smk10ddde.com/

Unpacked files

SH256 hash:

2c10f6776795d59fe038ed6b7ff9e2d1a710a027a35845e34e4cd5fef17892f8

MD5 hash:

30abc4ac02c157bc0872f2c8659c5d37

SHA1 hash:

08d639b601a5360dd094bdbc2fd6bbbddbdf3da0

Link:

https://www.unpac.me/results/d83d2601-3f58-412e-afa4-c7083dc5f323/

SH256 hash:

640326eaa9b6d1eebecf4925208ea87f31574b530e81b25575a5ab28f23ba90d

MD5 hash:

701f9a4e569369f69ec1c8d2114f5c09

SHA1 hash:

1964037544e248c943177d19b105e3e5594ca53f

Link:

https://www.unpac.me/results/d83d2601-3f58-412e-afa4-c7083dc5f323/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.