MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e2c3b22a461a389674c11303509a42746fd20a8c91b3e468bee71f28500f7c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 8

Intelligence 8 IOCs YARA File information Comments

SHA256 hash:	2e2c3b22a461a389674c11303509a42746fd20a8c91b3e468bee71f28500f7c6
SHA3-384 hash:	76666f0f5d6aa24fc3937259cc7252a0a14b51eccd1a901454171956d7c9e83efae3bad0d184bf3f499a3eb8870482ec
SHA1 hash:	5fd3e2a20b5dc790ab748dbd41131defdec13ca9
MD5 hash:	c2b79f67176c24ccdccf2572812949c2
humanhash:	white-quebec-network-gee
File name:	c2b79f67176c24ccdccf2572812949c2.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	278'528 bytes
First seen:	2021-08-25 18:12:43 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	1d03ad9b9e9a9068c266e5f5e715b4b7 (4 x Smoke Loader, 2 x RaccoonStealer, 1 x FickerStealer)
ssdeep	6144:vtO4bGUx6mXZy0GYs82f5fmNoT67iKy7Xf:ELUx6CZqYs82BmKu3y7Xf
Threatray	184 similar samples on MalwareBazaar
TLSH	T10C449C30AA91C035F5F252F855BA83BCA53A7AB16B3450CF53E126EE06346E5EC30B57
dhash icon	ead8ac9cc6e68ee0 (118 x RaccoonStealer, 102 x RedLineStealer, 46 x Smoke Loader)
Reporter	abuse_ch
Tags:	Dofoil exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

1'246

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

c2b79f67176c24ccdccf2572812949c2.exe

Verdict:

No threats detected

Analysis date:

2021-08-25 18:14:43 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/aa924e1a-0f9d-4d2e-9012-231d31c76556

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/182394/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Connection attempt

Sending an HTTP POST request

Creating a process from a recently created file

Deleting of the original file

Enabling autorun by creating a file

Unauthorized injection to a system process

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/9200da1b-1698-4746-90f6-8cf1fecae636

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/839306

Signature

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2e2c3b22a461a389674c11303509a42746fd20a8c91b3e468bee71f28500f7c6/

Threat name:

Win32.Trojan.Sabsik

Status:

Malicious

First seen:

2021-08-25 17:45:14 UTC

AV detection:

15 of 28 (53.57%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=fywdwivemgrysz2mceydkcnee5dp2ifizent4rul5zy7fbia67da._file

Verdict:

unknown

Smoke Loader

53bae18df82e9e787616370615c0b0af35fe420594843a24d0b32fef5fd6283c

Smoke Loader

640df13e7605d0fd539eaac1474643d4e6ab2f3519cab2450f9b755778dfac6e

Smoke Loader

6d69e8561d00ec74735297d21e777a9fe9b858b384292c38cb0239db2e3b73bd

Smoke Loader

7efe89836b4c06959a1af18891ff07995f8870f566149e8c537c6f76e2a31a89

Smoke Loader

af416b9b0b8c91937ee895050038b9de17f25735faa984c1d6dcf8d130c9d29b

Smoke Loader

b3001343a5ef8b5a947822a15cc2e983f63ede88598b70c317ae453899786227

Smoke Loader

b5f88e34db4bb65da8c21982590b67922fe32e62e7cfaae9fbe417a4262aa143

Smoke Loader

eccd8757ac5a6c34abc69c2251a582a6697d9cbb5af2d8c5f8f8787b3156c3ff

Smoke Loader

+ 174 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor trojan

Link:

https://tria.ge/reports/210825-lznzs9fm2a/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of UnmapMainImage

Deletes itself

SmokeLoader

Malware Config

C2 Extraction:

http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/