MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 372e3f20168cb6280781e04db5b47a84c3496bde190343f4cb54a7e80c4a0c6e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments

SHA256 hash:	372e3f20168cb6280781e04db5b47a84c3496bde190343f4cb54a7e80c4a0c6e
SHA3-384 hash:	ab97af896fa398507085ff8541ceaf6353b80fb1cffd9965d6c91b1a79cbc905257bd021390d93a54e6232da9bfa9da2
SHA1 hash:	96a5d909d78ae554a7c4a5963510976edb6904ee
MD5 hash:	62ddd6a52cc36031af700fe0b2f58e79
humanhash:	alanine-steak-montana-white
File name:	62ddd6a52cc36031af700fe0b2f58e79.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	318'976 bytes
First seen:	2021-06-20 08:10:35 UTC
Last seen:	2021-06-20 08:48:44 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	868eccae629fe626e7a9d52d5530b350 (12 x RedLineStealer, 2 x DanaBot, 1 x ArkeiStealer)
ssdeep	6144:z22oLY9ZJdv0HfudlNkXn23CVX+klvNhhuJSdgJKri:ILyZjv0HfudlqDVX3vNhoQol
Threatray	1'648 similar samples on MalwareBazaar
TLSH	0E649E00AAA0C035F7B662FC59BA936D652D7DB05B2490CB52E52BEE5B343E0ED31317
Reporter	abuse_ch
Tags:	Dofoil exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

344

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

62ddd6a52cc36031af700fe0b2f58e79.exe

Verdict:

Suspicious activity

Analysis date:

2021-06-20 08:12:28 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/333718ad-875a-4ba9-9b74-8b0fc7ccdc3c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

DLInjector01

Link:

https://www.capesandbox.com/analysis/167159/

Detection(s):

SecuriteInfo.com.Troj.Kryptik-TR.6732.5876.UNOFFICIAL

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

SmokeLoader

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3f67d1c6-cd1f-48cd-a257-b58f3c3ce076

Result

Threat name:

Raccoon SmokeLoader

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/804879

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to inject code into remote processes

Contains functionality to steal Internet Explorer form passwords

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

DLL reload attack detected

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Renames NTDLL to bypass HIPS

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to resolve many domain names, but no domain seems valid

Tries to steal Mail credentials (via file access)

Writes to foreign memory regions

Yara detected Raccoon Stealer

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/372e3f20168cb6280781e04db5b47a84c3496bde190343f4cb54a7e80c4a0c6e/

Threat name:

Win32.Backdoor.Mokes

Status:

Malicious

First seen:

2021-06-20 07:30:54 UTC

AV detection:

14 of 46 (30.43%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=g4xd6iawrs3cqb4b4bg3lnd2qtbus266debuh5glkst6qdckbrxa._file

Verdict:

malicious

Smoke Loader

1b7769f85c3874451b85f83ab1ddc08b0d07fe76f354e0c7b397308894095673

Smoke Loader

1f445aea75db35206f00610e21e04bcae95c26155f9fccb3dbbb7b8601ba1404

Smoke Loader

63761462358e1f880dafe51b3de8036f10bc60354b981cddc8075aed22e1251d

Smoke Loader

789e58502db7458fefcde8f8f920dfbf9299461146828ddba1b57d191b07e9c9

Smoke Loader

90c0cf976bc9377697fb31e8ca6f21aee0168cc5471a8ac33ece631ee346afa9

Smoke Loader

ae7ae9ea7fd0100b620704d462083caaedda2c5c5618ceeca54c1d7673b6be4a

Smoke Loader

b2c71a3b927301a484057e79c1d8a08c45512181b6378ca2627d34ddec49d4f4

Smoke Loader

b751a245f558db84cf77e46e473073e2dd23fbde9f9d150d63e525bbf4b88e8c

Smoke Loader

cce83bbb9fcc128a53c6f788a976bce242447d6c73deb097002ce9bb45b89cd0

Smoke Loader

+ 1'638 additional samples on MalwareBazaar

Result

Malware family:

vidar

Score:

10/10

Tags:

family:raccoon family:smokeloader family:tofsee family:vidar botnet:50f8ded12c46443e43915127b1219ac2fc439bb6 backdoor discovery evasion persistence spyware stealer trojan

Link:

https://tria.ge/reports/210620-bd1zgrjzb2/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Delays execution with timeout.exe

Kills process with taskkill

Modifies data under HKEY_USERS

Modifies registry class

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Launches sc.exe

Drops file in System32 directory

Suspicious use of SetThreadContext

Accesses 2FA software files, possible credential harvesting

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Looks up external IP address via web service

Deletes itself

Loads dropped DLL

Modifies file permissions

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Sets service image path in registry

Vidar Stealer

Raccoon

SmokeLoader

Tofsee

Vidar

Windows security bypass

Malware Config

C2 Extraction:

http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
http://999080321test61-service10020125999080321.website/
http://999080321test51-service10020125999080321.xyz/
http://999080321test41-service100201pro25999080321.ru/
http://999080321yest31-service100201rus25999080321.ru/
http://999080321rest21-service10020125999080321.eu/
http://999080321test11-service10020125999080321.press/
http://999080321newfolder4561-service10020125999080321.ru/
http://999080321rustest213-service10020125999080321.ru/
http://999080321test281-service10020125999080321.ru/
http://999080321test261-service10020125999080321.space/
http://999080321yomtest251-service10020125999080321.ru/
http://999080321yirtest231-service10020125999080321.ru/
http://nusurtal4f.net/
http://netomishnetojuk.net/
http://escalivrouter.net/
http://nick22doom4.net/
http://wrioshtivsio.su/
http://nusotiso4.su/
http://rickkhtovkka.biz/
http://palisotoliso.net/

Unpacked files

SH256 hash:

feac37e8974af1f9868c959ee101c7965d1ef8b399ef74ffb55dfaef3cfff8fc

MD5 hash:

b299a210a56aba5e4d3f2b5dba0a82a1

SHA1 hash:

69d24d62a1e9b1abe4d0458ebcf1f707a047b949

Link:

https://www.unpac.me/results/82553cfe-276b-4914-ae5f-7483bd718208/

SH256 hash:

372e3f20168cb6280781e04db5b47a84c3496bde190343f4cb54a7e80c4a0c6e

MD5 hash:

62ddd6a52cc36031af700fe0b2f58e79

SHA1 hash:

96a5d909d78ae554a7c4a5963510976edb6904ee

Link:

https://www.unpac.me/results/82553cfe-276b-4914-ae5f-7483bd718208/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/372e3f20168cb6280781e04db5b47a84c3496bde190343f4cb54a7e80c4a0c6e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.