MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 363388b9a8cc714944340308949c5675fc0a1a75c34ac0ae8989cc9c33a3b427. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 12

Intelligence 12 IOCs YARA File information Comments

SHA256 hash:	363388b9a8cc714944340308949c5675fc0a1a75c34ac0ae8989cc9c33a3b427
SHA3-384 hash:	80fb037de94337785a0d1eff5bcd7ee7c8cc86d68f4e4063922747b4aa23d92bda75046b1fc23c797fc64bcde8caf9ce
SHA1 hash:	5edfb6d17938151571707e71285a8cf682265f43
MD5 hash:	44f3df565ea513889480cab1dc41e07b
humanhash:	item-friend-low-georgia
File name:	44f3df565ea513889480cab1dc41e07b.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	160'256 bytes
First seen:	2021-11-02 07:48:57 UTC
Last seen:	2021-11-02 09:30:25 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	38efc42584ffe235e8d11c10897bfaf8 (3 x Smoke Loader, 2 x RedLineStealer, 1 x RaccoonStealer)
ssdeep	3072:hb5X6W+wv/+rnvlOTMuErXzRuaXngx+A:hbp+wOrntOLErdBn8
Threatray	2'594 similar samples on MalwareBazaar
TLSH	T1F0F38C20B2C2D471D4B616306875CBA51AFBBC721A34498B77A43B7E1EB13C05EF635A
File icon (PE):
dhash icon	fcfcd4d4d4d4d8c0 (75 x RedLineStealer, 56 x RaccoonStealer, 23 x Smoke Loader)
Reporter	abuse_ch
Tags:	Dofoil exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

202

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

44f3df565ea513889480cab1dc41e07b.exe

Verdict:

No threats detected

Analysis date:

2021-11-02 08:32:50 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/b2457e3e-6287-4442-846b-c595aee3d6a1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/201334/

Detection(s):

SecuriteInfo.com.Trojan.DownLoader43.55351.17096.27712.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching the default Windows debugger (dwwin.exe)

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/6180ed73bf51178dbe48053c/reports/26e7d07f-0bd5-4b6d-b680-6d7781aa0505/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

DanaBot

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/74cc47ca-ca6a-4433-bbdd-64a0219283d5

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/881051

Signature

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/363388b9a8cc714944340308949c5675fc0a1a75c34ac0ae8989cc9c33a3b427/

Threat name:

Win32.Trojan.CrypterX

Status:

Malicious

First seen:

2021-11-01 20:45:50 UTC

AV detection:

17 of 28 (60.71%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=gyzyronizryusrbuamejjhcwox6augtvynfmblujrhgjym5dwqtq._file

Verdict:

malicious

Smoke Loader

218ae2e9ccd0d778ca78c7aa8e9fd7101819507d0f9da4bfbc40687063bd7fd4

Smoke Loader

22b13294437f3dc3266f4517bf126e7f3b84d96c05f299f41a59887f7710338c

Smoke Loader

42e7ef551c652a5e6f0ff919fcb53cd2c34682006cb1436295205a41abec6589

Smoke Loader

5eff7e99184b9c8352125aaf8aa9d72e33049c52dc4eb7a69d509da3e7004cb2

Smoke Loader

62f94256e7fc124c7292edefd8b589dad48601ff53d4058848b91a788a981e14

Smoke Loader

672c2343ecbaba5e397027a9a13a04ef46e9d7036ae7a4ebf32336e3708d2af8

Smoke Loader

991e3c5fb9946ed0490a723a541bda0f36a9b94fff8a68f6729c15e1044dd954

Smoke Loader

d3184ceae376a789ccd61e767da3f21cacd72dfc7162a5e1a9569c7244d0bf9a

Smoke Loader

+ 2'584 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor trojan

Link:

https://tria.ge/reports/211102-jnr7pahaak/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Deletes itself

Executes dropped EXE

SmokeLoader

Malware Config

C2 Extraction:

http://brandyjaggers.com/upload/
http://andbal.com/upload/
http://alotofquotes.com/upload/
http://szpnc.cn/upload/
http://uggeboots.com/upload/
http://100klv.com/upload/
http://rapmusic.at/upload/