MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ef4e1dddd31d73ccff96b2611380c25148db5aab6f23f7a631079c6ad4a0769. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2ef4e1dddd31d73ccff96b2611380c25148db5aab6f23f7a631079c6ad4a0769
SHA3-384 hash: 9adf0af193ba09d7e1dfa43f8a083e9f8ebeeb385934b9c225610f9cfc8238111399529705144d2bdc650dfad18c92c5
SHA1 hash: 0df6862c936b79e51fcde9dd5892688bc62ecb20
MD5 hash: d15cc83dd857e9652c5a2ac775590c93
humanhash: triple-lithium-may-finch
File name:d15cc83dd857e9652c5a2ac775590c93.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:386'560 bytes
First seen:2020-10-14 14:42:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 712f4a29c405ecb576101d367b2180fb (14 x Smoke Loader, 2 x AZORult, 1 x Formbook)
ssdeep 6144:fof7DeNUSfGgHCU/2McdfoI/ZX0rYfCzuCCMQZN/OdnFQ8+uXNvxsCtrEKAPv:aYV6MorX7qzuC3QHO9FQgd5sCtoX
Threatray 807 similar samples on MalwareBazaar
TLSH 738412801BD2DD7AC09523B8D83BDC90682278B1CFD43B5A4399F52EB876787E40795E
Reporter abuse_ch
Tags:exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/70811/
Detection(s):
PUA.Win.Packer.Upx-48
Create hunting rule

PUA.Win.Packer.Upolyx-12
Create hunting rule

Win.Malware.SmokeLoader-9774773-1
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
DNS request
Sending a custom TCP request
Creating a file
Launching a process
Creating a process with a hidden window
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj.evad
Score:
68 / 100
Link:
https://www.joesandbox.com/analysis/491094
Signature
Antivirus / Scanner detection for submitted sample
Binary is likely a compiled AutoIt script file
Bypasses PowerShell execution policy
Connects to a pastebin service (likely for C&C)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2ef4e1dddd31d73ccff96b2611380c25148db5aab6f23f7a631079c6ad4a0769/
Threat name:
Win32.Trojan.GenUMlwr
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 01:11:07 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=f32odxo5ghltzt7znmtbcoameuki3nnkw3zd66tdcb44nlkka5uq._file
Verdict:
unknown
Similar samples:
28102f94dd691b7e8f350f294bb627cc5620188b9b8f3fb5fba6e822924105fe
Smoke Loader
3148f0c0266e7ec90e12a356b8a88a272f3dd4e88c7aa9db82da2788bd0dc2d5
Smoke Loader
62e9a9522a98f1a4ad322c5ef52fa3187a1204df9455d57766e4b221dc56fd35
Smoke Loader
b1cd81ef90363936ef04a6d5cabb539bbc4a89a25b6baf6777e1a3e373455f40
Smoke Loader
ca0ffb047bb011ae244daae2f9eb29e4e2db3d77817c5eea1636ce57b6c041cb
Smoke Loader
cda533fbcdc33bfc7242c90e8e0a72dd1448e78d4c40e7d9ae5bcd183f94ae7b
Smoke Loader
d99b374a5972bbdeb57de9c8a41cc6b8c3f8928916151a40257967baa855917b
Smoke Loader
ee21511b610cd2a154c85c04c0e3d88f82b0ee835afd51247a1a7e97900cd733
Smoke Loader
eee4d211bbffe896f0de21854cb5adac6e10c85016986efd260b45c7022d7521
Smoke Loader
fd6545dad035b74dea3eb7a3d62a3270331db331479a8194e32333abbec20da6
Smoke Loader
+ 797 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/201014-pe77m343ax/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Drops file in System32 directory
Unpacked files
SH256 hash:
2ef4e1dddd31d73ccff96b2611380c25148db5aab6f23f7a631079c6ad4a0769
MD5 hash:
d15cc83dd857e9652c5a2ac775590c93
SHA1 hash:
0df6862c936b79e51fcde9dd5892688bc62ecb20
Link:
https://www.unpac.me/results/40a0f941-f055-4696-8557-8749cf1c18ab/
SH256 hash:
488f1bb1ca7b8734292003877fbea094a1d942d215dd6e6dc4794bdaef237634
MD5 hash:
e9c58965bd0606223f1aa4b6abd81a5f
SHA1 hash:
d37137b8c1a4e6931bc3eb814180b1906a1c5cbe
Link:
https://www.unpac.me/results/40a0f941-f055-4696-8557-8749cf1c18ab/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Smokeloader
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2ef4e1dddd31d73ccff96b2611380c25148db5aab6f23f7a631079c6ad4a0769

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 2ef4e1dddd31d73ccff96b2611380c25148db5aab6f23f7a631079c6ad4a0769

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/70811/
  
URLhaus
https://urlhaus.abuse.ch/url/689203/
  
Delivery method
Distributed via web download

Comments