MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3357dd093d66a713e77783a5c131ec19806b6ed8497ebd4d973ea87693ecd63c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3357dd093d66a713e77783a5c131ec19806b6ed8497ebd4d973ea87693ecd63c
SHA3-384 hash: 726746e0cbd0757c571eb89917459b50da655d6a29333323b55a30a205a8a19ee772804b17f072a6e5651175527d78ab
SHA1 hash: 512296f51a6ee07d9b605e5a07d29f51e4abd760
MD5 hash: 92ac69e4ed3c472e664f0b7feba3f8ca
humanhash: hotel-princess-nevada-twelve
File name:92ac69e4ed3c472e664f0b7feba3f8ca.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:339'968 bytes
First seen:2021-10-27 16:26:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 81bc37a83512d3f79dc386c8801f39d0 (2 x Smoke Loader)
ssdeep 6144:uavwr+DUE5sWANehY4yn+VZlrTg33atL7GI2C3OFy:uSwrPEhvyGrTg33at0C3f
Threatray 2'241 similar samples on MalwareBazaar
TLSH T18E749E00A6A1C034F4B252FC59BA9369A83F79B15B7494CF53D51AEE4A74AE0FC31347
File icon (PE):PE icon
dhash icon b2dacabecee6baa2 (33 x RedLineStealer, 30 x Smoke Loader, 28 x Stop)
Reporter abuse_ch
Tags:Dofoil exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
278
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/200650/
Detection(s):
SecuriteInfo.com.Ransom.Stop.Z5.23851.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching the default Windows debugger (dwwin.exe)
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/61797ddadb358dd15ee03f0c/reports/fc047e98-107d-4235-9120-7d9db1e10772/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1c5b7ff0-e1a4-4553-a3c2-197ffacad980
Result
Threat name:
RedLine SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/877943
Signature
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 510377 Sample: XTLR18yv0F.exe Startdate: 27/10/2021 Architecture: WINDOWS Score: 100 41 Found malware configuration 2->41 43 Multi AV Scanner detection for submitted file 2->43 45 Yara detected SmokeLoader 2->45 47 5 other signatures 2->47 7 XTLR18yv0F.exe 2->7         started        10 dvubist 2->10         started        process3 signatures4 63 Detected unpacking (changes PE section rights) 7->63 65 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 7->65 67 Maps a DLL or memory area into another process 7->67 69 Creates a thread in another existing process (thread injection) 7->69 12 explorer.exe 6 7->12 injected 71 Multi AV Scanner detection for dropped file 10->71 73 Machine Learning detection for dropped file 10->73 75 Checks if the current machine is a virtual machine (disk enumeration) 10->75 process5 dnsIp6 35 brandyjaggers.com 124.109.61.160, 49777, 49778, 49785 NAYATEL-PKNayatelPvtLtdPK Pakistan 12->35 37 193.142.59.113, 49780, 49799, 80 HOSTSLICK-GERMANYNL Netherlands 12->37 39 5 other IPs or domains 12->39 23 C:\Users\user\AppData\Roaming\dvubist, PE32 12->23 dropped 25 C:\Users\user\AppData\Local\Temp\95BA.exe, PE32 12->25 dropped 27 C:\Users\user\AppData\Local\Temp\6221.exe, PE32 12->27 dropped 29 C:\Users\user\...\dvubist:Zone.Identifier, ASCII 12->29 dropped 77 System process connects to network (likely due to code injection or exploit) 12->77 79 Benign windows process drops PE files 12->79 81 Deletes itself after installation 12->81 83 Hides that the sample has been downloaded from the Internet (zone.identifier) 12->83 17 95BA.exe 3 12->17         started        21 6221.exe 5 12->21         started        file7 signatures8 process9 dnsIp10 31 185.215.113.29, 36224, 49858 WHOLESALECONNECTIONSNL Portugal 17->31 49 Detected unpacking (changes PE section rights) 17->49 51 Detected unpacking (overwrites its own PE header) 17->51 53 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 17->53 55 Tries to harvest and steal browser information (history, passwords, etc) 17->55 33 193.150.103.37, 29118, 49839 ASGENERALTELRU Russian Federation 21->33 57 Machine Learning detection for dropped file 21->57 59 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 21->59 61 Tries to steal Crypto Currency Wallets 21->61 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3357dd093d66a713e77783a5c131ec19806b6ed8497ebd4d973ea87693ecd63c/
Threat name:
Win32.Trojan.Strab
Create hunting rule
Status:
Malicious
First seen:
2021-10-27 15:40:08 UTC
AV detection:
17 of 27 (62.96%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gnl52cj5m2trhz3xqos4cmpmdgagw3wyjf7l2tmxh2uhne7m2y6a._file
Verdict:
malicious
Similar samples:
22b13294437f3dc3266f4517bf126e7f3b84d96c05f299f41a59887f7710338c
Smoke Loader
2d320ee3c680e6b5c2cbf5a781895dac33cf08190e3db8805dd9775ec4bd87d3
Smoke Loader
33e40835a9c6e471ece9819aa162eab8327e17967d5952468e33ecdebad7c3b0
Smoke Loader
62f94256e7fc124c7292edefd8b589dad48601ff53d4058848b91a788a981e14
Smoke Loader
672c2343ecbaba5e397027a9a13a04ef46e9d7036ae7a4ebf32336e3708d2af8
Smoke Loader
8577213832eecf00f77003ddf49fb6630af4906b10b350f9dd88a899d9720a98
Smoke Loader
d3184ceae376a789ccd61e767da3f21cacd72dfc7162a5e1a9569c7244d0bf9a
Smoke Loader
+ 2'231 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor trojan
Link:
https://tria.ge/reports/211027-tx4besffa7/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Deletes itself
SmokeLoader
Malware Config
C2 Extraction:
http://brandyjaggers.com/upload/
http://andbal.com/upload/
http://alotofquotes.com/upload/
http://szpnc.cn/upload/
http://uggeboots.com/upload/
http://100klv.com/upload/
http://rapmusic.at/upload/
Unpacked files
SH256 hash:
f9b4b2e506fe88e1cd921a71c130a7e097bfb2dd1cfcec768b375c70ee6b800c
MD5 hash:
986d781d5e3181045ce6586b2b0af221
SHA1 hash:
8e21f86221892e43c95adfe05f385135fbf6886f
Link:
https://www.unpac.me/results/94e44b0e-40a2-422b-ab21-5ecc69637dda/
SH256 hash:
3357dd093d66a713e77783a5c131ec19806b6ed8497ebd4d973ea87693ecd63c
MD5 hash:
92ac69e4ed3c472e664f0b7feba3f8ca
SHA1 hash:
512296f51a6ee07d9b605e5a07d29f51e4abd760
Link:
https://www.unpac.me/results/94e44b0e-40a2-422b-ab21-5ecc69637dda/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/3357dd093d66/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3357dd093d66a713e77783a5c131ec19806b6ed8497ebd4d973ea87693ecd63c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 3357dd093d66a713e77783a5c131ec19806b6ed8497ebd4d973ea87693ecd63c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1717813/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/200650/

Comments