MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2eafd204076978f8a4a3e39ab0b8dd4cbed9bec5a4ac39146e40d921c8af59ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 8

Intelligence 8 IOCs YARA File information Comments

SHA256 hash:	2eafd204076978f8a4a3e39ab0b8dd4cbed9bec5a4ac39146e40d921c8af59ff
SHA3-384 hash:	c79be2830489da034b4958a6712c1276504f55df37b63edacea24790f70a2bfbdf7c4c0a07bb7fe4055d42af07eafe35
SHA1 hash:	ae5ed433c08b4823652158678076f12b8588c1b6
MD5 hash:	bfcc028b11046ba83e472990c9c9f5a0
humanhash:	river-uniform-echo-blossom
File name:	bfcc028b11046ba83e472990c9c9f5a0.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	334'848 bytes
First seen:	2020-11-12 09:22:09 UTC
Last seen:	2024-07-24 12:43:43 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	c1f7f036cdb13b66723a8af734ecfe50 (8 x CobaltStrike, 2 x Smoke Loader)
ssdeep	3072:lw00yBke2xOLLTjx14RYdrjCgUVDyvO/zzgEO347PTiCN0QiqjjjjjjjpuOq7K:lfjkZxOL91lvCgsDbGaiw0Q9N
Threatray	64 similar samples on MalwareBazaar
TLSH	28649D1171A0C0F1C5B60D315765F7E026BDB86157A449C73BA8EB2A1E253F0EA7A38F
Reporter	abuse_ch
Tags:	exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

115

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.Siggen11.881.17998.20334.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a file in the %temp% directory

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Sending an HTTP POST request

Sending an HTTP GET request

Creating a process from a recently created file

Launching a process

Searching for the window

Creating a process with a hidden window

Reading critical registry keys

Creating a window

Creating a file in the %AppData% subdirectories

Running batch commands

Setting browser functions hooks

Unauthorized injection to a system process

Deleting of the original file

Enabling autorun by creating a file

Unauthorized injection to a browser process

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Qbot SmokeLoader

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/532254

Signature

Benign windows process drops PE files

Binary contains a suspicious time stamp

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to detect virtual machines (IN, VMware)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Renames NTDLL to bypass HIPS

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected Qbot

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2eafd204076978f8a4a3e39ab0b8dd4cbed9bec5a4ac39146e40d921c8af59ff/

Threat name:

Win32.Trojan.Glupteba

Status:

Malicious

First seen:

2020-11-12 09:23:05 UTC

AV detection:

24 of 28 (85.71%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=f2x5ebahnf4prjfd4onlbog5js7ntpwfuswdsfdoidmsdsfplh7q._file

Verdict:

malicious

Smoke Loader

8f32a2bc4817137939fbd615fbcbab4c93dd0305e9d407ec6de706483c50556e

Smoke Loader

91647ac947d5d5d3a0dc69e98070bfc2f9841d7839b579d69c524b02869a497f

Smoke Loader

91a949a238f887601af94c9ab7921352102b1edc24aba6e4ab6d726a8c314843

Smoke Loader

95a4cf409c7e7813bfa744598bee2e0e572b2d05ec31622867237ea6dab8a813

Smoke Loader

a99dfa4b60347edac3d2083c96df817bc3dfdc3c206be400723abb594cdb510b

Smoke Loader

ad5592929818b5ee09b99dddb8a652d84621e0b70efe51c2f2b6ca54aeaa3713

Smoke Loader

d95b7c505dbb3905f88c71bb1efedfe716a0d65862a622eb932f3d774a07a740

Smoke Loader

e237d6e3b44c0bcacf4eff59f58c8028a48c0675f283adc96490ae6daf645bd7

Smoke Loader

e934da8d0b455bcdf23e6e9c2fa5580982bf2f9b39a5d0246b2f462bbf1ae141

Smoke Loader

+ 54 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:qakbot family:smokeloader botnet:tr01 campaign:1604997522 backdoor banker spyware stealer trojan

Link:

https://tria.ge/reports/201112-811kf6ggss/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Deletes itself

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

SmokeLoader

Qakbot/Qbot

Malware Config

C2 Extraction:

http://we11wdsgd.com/
122.61.213.85:443
2.50.89.119:995
189.183.201.0:443
86.98.145.152:2222
96.241.66.126:443
90.101.117.122:2222
94.69.112.148:2222
81.150.181.168:2222
82.127.125.209:2222
81.214.126.173:2222
86.140.82.116:20
172.87.157.235:443
176.181.247.197:443
78.97.110.47:443
5.15.90.117:2222
41.206.131.156:443
151.73.112.67:443
82.127.125.209:990
197.45.110.165:995
81.133.234.36:2222
37.6.222.192:995
118.100.108.25:443
86.97.162.141:2222
74.129.26.119:443
37.116.152.122:2222
92.154.83.96:1194
45.32.154.10:443
45.63.107.192:443
207.246.75.201:443
59.99.38.231:443
45.63.107.192:2222
195.97.101.40:443
45.63.107.192:995
199.247.16.80:443
199.247.22.145:443
80.240.26.178:443
108.52.39.68:443
203.106.195.67:443
2.50.143.154:2222
73.166.10.38:443
84.232.252.202:2222
47.146.39.147:443
69.40.22.180:443
73.239.229.107:995
71.187.177.20:443
50.244.112.90:443
67.61.157.208:443
45.118.65.34:443
217.128.117.218:2222
47.22.148.6:443
50.82.55.69:443
75.136.40.155:443
82.76.47.211:443
68.186.192.69:443
71.187.170.235:443
2.50.244.155:443
80.14.209.42:2222
196.204.207.111:443
78.132.115.83:6881
180.233.150.134:443
185.163.221.77:2222
41.206.131.166:443
149.28.99.97:2222
149.28.99.97:443
149.28.99.97:995
117.199.12.148:443
83.110.12.0:2222
2.50.110.49:2078
93.86.252.177:995
79.113.242.120:443
68.174.15.223:443
94.52.160.116:443
41.205.16.176:443
84.117.176.32:443
217.133.54.140:32100
185.105.131.233:443
87.27.110.90:2222
77.159.149.74:443
105.101.88.222:443
185.246.9.69:995
188.25.24.21:2222
2.90.127.64:443
86.97.191.98:2222
31.5.168.31:443
41.225.13.128:8443
24.205.42.241:443
41.97.173.199:443
105.198.236.101:443
190.220.8.10:995
197.161.154.132:443
24.90.129.73:443
120.150.34.178:443
122.60.99.107:443
27.223.92.142:995
96.41.93.96:443
109.209.94.165:2222
189.231.189.64:443
58.179.21.147:995
2.51.153.24:443
149.135.101.20:443
74.135.122.35:443
82.127.125.209:22
96.21.251.127:2222
98.116.20.194:443
39.32.61.193:995
173.173.1.164:443
109.205.204.229:2222
78.96.199.79:443
73.136.242.114:443
198.2.35.226:2222
156.205.170.226:995
117.197.231.67:443
41.227.93.43:443
89.136.39.108:443
207.246.70.216:443
45.32.165.134:443
45.32.162.253:443
140.82.27.132:443
37.106.36.31:995
45.63.104.123:443
63.155.67.114:995
96.30.198.161:443
95.179.247.224:443
188.27.32.167:443
108.31.15.10:995
81.88.254.62:443
184.66.18.83:443
73.55.254.225:443
184.98.97.227:995
216.215.77.18:2222
5.32.41.46:443
144.139.230.139:443
69.47.26.41:443
197.86.204.198:443
72.241.205.69:443
89.137.211.239:443
86.122.246.127:2222
197.47.160.202:995
24.137.76.62:995
86.248.30.56:2222
31.5.21.66:443
212.70.107.59:995
2.7.202.106:2222
72.36.59.46:2222
71.238.211.125:443
2.181.78.140:2222
81.97.154.100:443
47.44.217.98:443