MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 375798f97452cb9143ffb08922bebb13eb6bb0c27a101ebc568a3e5295361936. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 375798f97452cb9143ffb08922bebb13eb6bb0c27a101ebc568a3e5295361936
SHA3-384 hash: 52133dfdee78d2af38aa394b26beda5d543897c4374db7d66c387bfb573f4033397294475abc47510bdd65169a3dd4ab
SHA1 hash: 742e8e1701b03a0638eec505e17ad453a612ac5e
MD5 hash: 642917731c4f19a1b7a1fab2333a84d2
humanhash: louisiana-pluto-edward-eighteen
File name:AKT_28_05_2023p._pax_28_05_2023p.vbs
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:23'454 bytes
First seen:2023-05-30 07:44:00 UTC
Last seen:2023-05-30 12:02:59 UTC
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 384:Ym0ICzXSsFmDFFlhPAO0SBVNKemRJ0pIu+5B70VVa4EdPBS0d928DYGm3Mq:Y7UZL0ouNia4y7/sVL
Threatray 68 similar samples on MalwareBazaar
TLSH T1C0B27D6D034FA8F89773ACC88AD5AC53FB7487264A7CCA889F30FEE92411174A4E551C
Reporter abuse_ch
Tags:Dofoil Smoke Loader vbs

Intelligence

File Origin
# of uploads :
2
# of downloads :
306
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/393350/
Detection(s):
SecuriteInfo.com.VBS.Malware-gen.27659.19777.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6475a9456407f39ba8adc060/reports/36e24827-37e5-4066-89cd-a44371b3f442/overview
Verdict:
Malicious
Labled as:
Trojan.Script
Link:
https://www.hybrid-analysis.com/sample/375798f97452cb9143ffb08922bebb13eb6bb0c27a101ebc568a3e5295361936
Result
Verdict:
SUSPICIOUS
Result
Threat name:
SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1245453
Signature
Antivirus detection for URL or domain
Benign windows process drops PE files
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Detected unpacking (changes PE section rights)
Encrypted powershell cmdline option found
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PowerShell case anomaly found
Powershell drops PE file
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to download HTTP data from a sinkholed server
Tries to resolve many domain names, but no domain seems valid
VBScript performs obfuscated calls to suspicious functions
Wscript starts Powershell (via cmd or directly)
Yara detected Powershell download and execute
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 878464 Sample: AKT_28_05_2023p._pax_28_05_... Startdate: 30/05/2023 Architecture: WINDOWS Score: 100 46 Tries to download HTTP data from a sinkholed server 2->46 48 Multi AV Scanner detection for domain / URL 2->48 50 Found malware configuration 2->50 52 8 other signatures 2->52 9 wscript.exe 1 2->9         started        12 rhiuwub 2->12         started        process3 signatures4 66 VBScript performs obfuscated calls to suspicious functions 9->66 68 Wscript starts Powershell (via cmd or directly) 9->68 70 PowerShell case anomaly found 9->70 14 cmd.exe 1 9->14         started        72 Multi AV Scanner detection for dropped file 12->72 74 Detected unpacking (changes PE section rights) 12->74 76 Machine Learning detection for dropped file 12->76 78 4 other signatures 12->78 process5 signatures6 88 Suspicious powershell command line found 14->88 90 Wscript starts Powershell (via cmd or directly) 14->90 92 Encrypted powershell cmdline option found 14->92 94 2 other signatures 14->94 17 powershell.exe 14 17 14->17         started        22 conhost.exe 14->22         started        process7 dnsIp8 36 lamazone.site 176.124.193.111, 49698, 49699, 49703 GULFSTREAMUA Russian Federation 17->36 38 americanocoffea.ru 17->38 32 C:\Users\user\AppData\Local\...\bWlYQHJZ.exe, PE32 17->32 dropped 54 Powershell drops PE file 17->54 24 bWlYQHJZ.exe 17->24         started        file9 56 Tries to resolve many domain names, but no domain seems valid 36->56 signatures10 process11 signatures12 58 Multi AV Scanner detection for dropped file 24->58 60 Detected unpacking (changes PE section rights) 24->60 62 Machine Learning detection for dropped file 24->62 64 3 other signatures 24->64 27 explorer.exe 5 2 24->27 injected process13 dnsIp14 40 zakolibal.online 27->40 42 zaikaopentra.com.ug 27->42 44 25 other IPs or domains 27->44 34 C:\Users\user\AppData\Roaming\rhiuwub, PE32 27->34 dropped 80 System process connects to network (likely due to code injection or exploit) 27->80 82 Benign windows process drops PE files 27->82 84 Hides that the sample has been downloaded from the Internet (zone.identifier) 27->84 file15 86 Tries to resolve many domain names, but no domain seems valid 42->86 signatures16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/375798f97452cb9143ffb08922bebb13eb6bb0c27a101ebc568a3e5295361936/
Threat name:
Script-WScript.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2023-05-30 06:59:38 UTC
File Type:
Text (VBS)
AV detection:
8 of 24 (33.33%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g5lzr6luklfzcq77wcesfpv3cpvwxmgcpiib5pcwri7fffjwde3a._file
Verdict:
malicious
Similar samples:
069b749dc167bae6560ea3f73a461184f0380f6ae3ffcfc095488063da4f9554
Smoke Loader
24089814a99edccddb1a0b87184bb27b1838fb78c91becfb5735b2f187c48f6c
Smoke Loader
3350f50e705b773254b1506e65950b9d610e97b6d002fd02c0307f1e8abf2a3a
Smoke Loader
5572abc4caa2343e8c96aeb83fd77cc2c18749d261029e8148bb5fa404d9c810
Smoke Loader
835c06d3710a51048d4911a2f312704e654701c12174a3337ab4ab27de8aa46a
Smoke Loader
8c52b7aff318185c82a7c08e6f662d9fe223b016d1c01b16b92c2f83fc712fb2
Smoke Loader
a19db6939acfd18c5b6db81339722a8cb0f4130f5d95dab84fb9b485ce56a48c
Smoke Loader
de4244c39dd311be6abb54bf14f8c8c687da1b2b6a1b74b32c0a6a5ad09df0c4
Smoke Loader
f099192fa0abddedf802c4f4968271608f0d8b7c659a0defc95080120ce2192d
Smoke Loader
f892a86d4af2c61bf9284c3cf6608eb003b6a5570829ed3dbecb28eb69bc50d2
Smoke Loader
+ 58 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor trojan
Link:
https://tria.ge/reports/230530-jktlcagc45/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Enumerates physical storage devices
Checks computer location settings
Executes dropped EXE
Blocklisted process makes network request
Downloads MZ/PE file
SmokeLoader
Malware Config
C2 Extraction:
http://polinamailserverip.ru/
http://lamazone.site/
http://criticalosl.tech/
http://maximprofile.net/
http://zaliphone.com/
http://humanitarydp.ug/
http://zaikaopentra.com.ug/
http://zaikaopentra-com-ug.online/
http://infomalilopera.ru/
http://jskgdhjkdfhjdkjhd844.ru/
http://jkghdj2993jdjjdjd.ru/
http://kjhgdj99fuller.ru/
http://azartnyjboy.com/
http://zalamafiapopcultur.eu/
http://hopentools.site/
http://kismamabeforyougo.com/
http://kissmafiabeforyoudied.eu/
http://gondurasonline.ug/
http://nabufixservice.name/
http://filterfullproperty.ru/
http://alegoomaster.com/
http://freesitucionap.com/
http://droopily.eu/
http://prostotaknet.net/
http://zakolibal.online/
http://verycheap.store/
Dropper Extraction:
http://americanocoffea.ru
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/375798f97452/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/375798f97452cb9143ffb08922bebb13eb6bb0c27a101ebc568a3e5295361936

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Smoke Loader

Visual Basic Script (vbs) vbs 375798f97452cb9143ffb08922bebb13eb6bb0c27a101ebc568a3e5295361936

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/393350/

Comments