MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 314e14253125545a7987e0f8c160cd2f2db450fce81e57151ae61b8bec2ca86c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 17


Intelligence 17 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 314e14253125545a7987e0f8c160cd2f2db450fce81e57151ae61b8bec2ca86c
SHA3-384 hash: 1c364618f4b73e27cab627d86807eb796b6738a870792166753f2f5fa13cba721325f84ec89f614b5cf4b1f52940489e
SHA1 hash: 057aae5d726aabe2e1193aaa7f93ea2cd316c595
MD5 hash: 4dc87f81349376b17c6b6d6936dae918
humanhash: glucose-orange-maine-item
File name:toolspub1.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:262'656 bytes
First seen:2024-01-16 01:23:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ac8f1ece26b6fcbaefd9ab768b1f60d3 (2 x Smoke Loader, 1 x Tofsee, 1 x Stealc)
ssdeep 3072:ylrJL/wsH8F9PL3TYOfiHhDs902lbJt5hH4W5601:y3L/w287EDs9NH4W0
Threatray 2'324 similar samples on MalwareBazaar
TLSH T1D2444A3392E17C52E9264B7A9F2E8EFC771FB5514E59776A22085E1B08713B2F263301
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 0209131111111100 (1 x Smoke Loader)
Reporter adm1n_usa32
Tags:exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
352
Origin country :
RO RO
Vendor Threat Intelligence
Malware family:
smoke
Create hunting rule
ID:
1
File name:
314e14253125545a7987e0f8c160cd2f2db450fce81e57151ae61b8bec2ca86c.exe
Verdict:
Malicious activity
Analysis date:
2024-01-16 01:25:23 UTC
Tags:
loader smoke smokeloader
Link:
https://app.any.run/tasks/4112164d-e2a2-4957-8256-d9120d630970

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
SmokeLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/471032/
Detection(s):
Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/65a5dab3e1815911f169aa4e/reports/c6b7ffb7-1b63-4182-8601-62a6498f3c57/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/314e14253125545a7987e0f8c160cd2f2db450fce81e57151ae61b8bec2ca86c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/e8897c25-a52a-4256-9bab-cbfdb4ac0ccc
Result
Threat name:
SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1375104
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/314e14253125545a7987e0f8c160cd2f2db450fce81e57151ae61b8bec2ca86c
Detection:
smokeloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/314e14253125545a7987e0f8c160cd2f2db450fce81e57151ae61b8bec2ca86c/
Threat name:
Win32.Trojan.Smokeloader
Create hunting rule
Status:
Malicious
First seen:
2024-01-16 01:24:06 UTC
File Type:
PE (Exe)
Extracted files:
49
AV detection:
20 of 24 (83.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gfhbijjrevkfu6mh4d4mcygnf4w3iuh45apfofi24ynyx3bmvbwa._file
Verdict:
malicious
Similar samples:
314e14253125545a7987e0f8c160cd2f2db450fce81e57151ae61b8bec2ca86c
Smoke Loader
461f0f86f52bfa5fbed84023d0a9c8652bcbca34fea76ad0cb5bb8c503b65c9a
Smoke Loader
684202dd303344e236b114ccbb30672673a796026a5f22df25fb9ba48d07d436
Smoke Loader
a30fd19d51949d7b6208f21a1d79ab8537f723f6a595927f49d20cb7a9fb618d
Smoke Loader
d0c824e886f14b8c411940a07dc133012b9eed74901b156233ac4cac23378add
Smoke Loader
d0cb3e1d35598d959dd03c288f0f55bc0e2368ca1172948a2bc4b7b1b848d11c
Smoke Loader
d9a4500412cd005acab7002a04bfaf92915fb177303173fb64004e9537f3c0fd
Smoke Loader
+ 2'314 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor trojan
Link:
https://tria.ge/reports/240116-bsdabsbdc8/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of UnmapMainImage
Uses Task Scheduler COM API
Deletes itself
SmokeLoader
Malware Config
C2 Extraction:
http://trad-einmyus.com/index.php
http://tradein-myus.com/index.php
http://trade-inmyus.com/index.php
Unpacked files
SH256 hash:
9d813606853f7cc9e8cb0ae3f710354f245f5b28e36f35ee090a9116b43cadb2
MD5 hash:
5ea1b484b0a3de21e5e3f38e9a8a0c73
SHA1 hash:
8edaa32491c1e0a146e842c4847aadf8b03cf165
Detections:
SmokeLoaderStage2
Create hunting rule
win_smokeloader_a2
Create hunting rule
Link:
https://www.unpac.me/results/ae9e74da-e1f0-4cfa-9bce-211a04be8915/
SH256 hash:
314e14253125545a7987e0f8c160cd2f2db450fce81e57151ae61b8bec2ca86c
MD5 hash:
4dc87f81349376b17c6b6d6936dae918
SHA1 hash:
057aae5d726aabe2e1193aaa7f93ea2cd316c595
Link:
https://www.unpac.me/results/ae9e74da-e1f0-4cfa-9bce-211a04be8915/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/314e14253125/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/314e14253125545a7987e0f8c160cd2f2db450fce81e57151ae61b8bec2ca86c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 314e14253125545a7987e0f8c160cd2f2db450fce81e57151ae61b8bec2ca86c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2735135/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2728080/
Cape
Cape
https://www.capesandbox.com/analysis/471032/

Comments