MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 359c7a9295f5c54a78cde6981f6637e134fc7a23819e80f928ea805bcf98430f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 17

Intelligence 17 IOCs YARA 5 File information Comments 1

SHA256 hash:	359c7a9295f5c54a78cde6981f6637e134fc7a23819e80f928ea805bcf98430f
SHA3-384 hash:	53505ffd9df595c49c1a95d73c39a35719cb325bed3436d035d0fe2a89b9662b2b65570efe5187d82797d9147622889b
SHA1 hash:	61e53f5fa97f3698574ac943ad65222230d894fc
MD5 hash:	94f72fb0dd8cccb47991ae035ff81bfa
humanhash:	pennsylvania-indigo-winter-alanine
File name:	94f72fb0dd8cccb47991ae035ff81bfa
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	265'728 bytes
First seen:	2023-10-21 22:07:27 UTC
Last seen:	2023-10-21 22:37:16 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	1a993c5a381c8e12968253c74a42dfae (3 x Smoke Loader, 2 x Stealc, 2 x Tofsee)
ssdeep	3072:Hx1BNhcJA/mq9OPKGLstg6yDBW1FozitpmqIoVDuedV4KBwn0J:VjCA/h9OCGstzyD0XRM6Tun
Threatray	2'244 similar samples on MalwareBazaar
TLSH	T14244C011B6D0D472E1A329355870C6961A37FCB2AA3446CB37983E3EAE316C08B65F43
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	70d0dcc0d9d0d2dd (1 x Smoke Loader)
Reporter	zbetcheckin
Tags:	32 exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

319

Origin country :

Vendor Threat Intelligence

Malware family:

smoke

ID:

File name:

94f72fb0dd8cccb47991ae035ff81bfa

Verdict:

Malicious activity

Analysis date:

2023-10-21 22:08:59 UTC

Tags:

loader smoke

Link:

https://app.any.run/tasks/18a31d7e-0d02-452f-8eae-ff729c3b585d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win32.BotX-gen.14439.1671.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Sending an HTTP POST request

Creating a process from a recently created file

Enabling autorun by creating a file

Unauthorized injection to a system process

Gathering data

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware

Link:

https://www.filescan.io/uploads/65344bc52614136586e8ea06/reports/09d6579e-642a-4aa8-b95b-45698b418014/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/359c7a9295f5c54a78cde6981f6637e134fc7a23819e80f928ea805bcf98430f

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/d0aafaf9-ff1e-4c26-81d2-3a282d7465d2

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1329770

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/359c7a9295f5c54a78cde6981f6637e134fc7a23819e80f928ea805bcf98430f

Detection:

smokeloader

Link:

https://mwdb.cert.pl/sample/359c7a9295f5c54a78cde6981f6637e134fc7a23819e80f928ea805bcf98430f/

Threat name:

Win32.Trojan.Smokeloader

Status:

Malicious

First seen:

2023-10-21 22:08:07 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gwohveuv6xcuu6gn42mb6zrx4e2py6rdqgpib6ji5kafxt4yimhq._file

Verdict:

malicious

Smoke Loader

2555138d315fe335a9cc77ad2c3f8b0bbd0e066f38db784774b26ba2537a0900

Smoke Loader

8282c76d3fbe900b90d4cc171b116191362effd2ca851d3552742aabbf77ecf9

Smoke Loader

84ef2a0c4a530be1aecad44326446853d4a083a90f3a48fc4954f4a2460671d6

Smoke Loader

8d423d5ee4bc84fc088ff35fda7656d0385d35fe1fd6c3cc575c9699cfbb7e62

Smoke Loader

a9a883582cb7a18b20c2bee6c896342ddb37a8241fc670b75e089ab5eb4b1932

Smoke Loader

bcd8f52b8001a64e39f3b0d2d19989527704d472f002c16e82e100eff38605a0

Smoke Loader

d3ff42e30d8fab9324a80f08e50445a1fcf72fa2cfe410043785bf4ff4c637ae

Smoke Loader

eafe43d5f59f732f56db205872cd55690916a0b26874bb080ab752d86704b97d

Smoke Loader

ed5858af8476036c1914ff346745b794c74a98bbb2fa8edba77bfc497a6471a8

Smoke Loader

+ 2'234 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader botnet:pub4 backdoor trojan

Link:

https://tria.ge/reports/231021-117xcacc7y/

Behaviour

Suspicious use of FindShellTrayWindow

Uses Task Scheduler COM API

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Deletes itself

SmokeLoader

Malware Config

C2 Extraction:

http://wirtshauspost.at/tmp/
http://msktk.ru/tmp/
http://soetegem.com/tmp/
http://gromograd.ru/tmp/
http://talesofpirates.net/tmp/

Unpacked files

SH256 hash:

1841ba0efee1c1739a985c5ce8ba50499b1d9a3998179f8c60cad37de06e94cf

MD5 hash:

e160632d3059af565697d32002485b5a

SHA1 hash:

b3a5839301c9cd4fefec03d8468bf84cb61451a3

Detections:

SmokeLoaderStage2

win_smokeloader_a2

Link:

https://www.unpac.me/results/ec68ce06-6a96-43e2-8045-5a564393d7bf/

Parent samples :

ed3d3c7ea2def6256c7c068239abf27ad41589859675386a391dbb30b07eb57c
6a302e65ae3cd7ceb6a94b2753f1a3223b189355eecbe443b0fd45722a495f48
661619bee5d7b2c990720d645d7def09c3de41a964acc6ddc77866b8e283a37b
f3690441d255e923934221ee1e394f3536a11ce793d34c6466ce7a29e2577857
19119a6c77015d4648fb38250614b86fd3f6ffd5e1b4ebc457eef2f90db46e6a
99063294db6384dbe30caa07b0dccca9a8c62276f2987d0c643d0ea7bb8b4ff2
ed5858af8476036c1914ff346745b794c74a98bbb2fa8edba77bfc497a6471a8
35416fc3b1be5d63574fab368830e544a73a1dd15a6b68f0859f85f2097d7355
212f3f74cd96e2e08855fabc350bd0e96af86c025eebfcec8a9b78d153b70985
359c7a9295f5c54a78cde6981f6637e134fc7a23819e80f928ea805bcf98430f
898a57544bdfbaac62372f1b7bc63610750c0f377c66c372e34909e6c5f474c5

SH256 hash:

359c7a9295f5c54a78cde6981f6637e134fc7a23819e80f928ea805bcf98430f

MD5 hash:

94f72fb0dd8cccb47991ae035ff81bfa

SHA1 hash:

61e53f5fa97f3698574ac943ad65222230d894fc

Link:

https://www.unpac.me/results/ec68ce06-6a96-43e2-8045-5a564393d7bf/

Malware family:

SmokeLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/359c7a9295f5/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/359c7a9295f5c54a78cde6981f6637e134fc7a23819e80f928ea805bcf98430f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__ConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	pe_no_import_table Create hunting rule
Author:	qux
Description:	Detects exe does not have import table

Rule name:	Windows_Trojan_Smokeloader_3687686f Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

exe 359c7a9295f5c54a78cde6981f6637e134fc7a23819e80f928ea805bcf98430f

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2712503/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-10-21 22:07:28 UTC

url : hxxps://wahaaudit.ps/tmp/index.php