MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 375bc3e906ba184369288f6b09889fa45afeedc9529f86749e4b2dcd3af73b9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 375bc3e906ba184369288f6b09889fa45afeedc9529f86749e4b2dcd3af73b9f
SHA3-384 hash: 486b28490ea0647b395a593fe43b4b8c869c5bd067754fd222946041d8d4110f79e32e0b296b0762e1a964e03c4fb248
SHA1 hash: 4a392aaef758ceb59f43b44882e531e6b257458d
MD5 hash: f8d0489e9608a5f4bcc54a9ec542171b
humanhash: october-carbon-salami-helium
File name:SecuriteInfo.com.W32.AIDetect.malware2.12445.5597
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:275'968 bytes
First seen:2021-08-21 13:54:49 UTC
Last seen:2021-08-21 14:48:58 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 74369709aeb55fd7f8dd333fd3dc6eee (4 x Smoke Loader, 3 x RedLineStealer, 2 x RaccoonStealer)
ssdeep 6144:72uJ5Jp/0MtRyMSVB918sVehYEUMiR3Hz:xvJp/dtRaVBvj4hcMiR3T
Threatray 377 similar samples on MalwareBazaar
TLSH T1ED448C20A7A0C139E4F711F4987DA3BC692D7DB06B2050CB62D626EE66372D4DD30797
dhash icon ead8ac9cc6e68ee0 (118 x RaccoonStealer, 102 x RedLineStealer, 46 x Smoke Loader)
Reporter SecuriteInfoCom
Tags:exe Smoke Loader

Intelligence

File Origin
# of uploads :
2
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
526b62ef1d4102a35956115343366bf4
Verdict:
Malicious activity
Analysis date:
2021-08-21 11:43:02 UTC
Tags:
trojan stealer raccoon loader opendir
Link:
https://app.any.run/tasks/785f2dea-413c-476e-ac85-36b6dc8df735

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/181082/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.12445.5597.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %AppData% subdirectories
Launching a process
DNS request
Sending a UDP request
Creating a process from a recently created file
Enabling autorun by creating a file
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
DanaBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d30191c5-4e18-4dae-8db2-9e3e3bdf56ca
Result
Threat name:
Clipboard Hijacker
Create hunting rule
Detection:
malicious
Classification:
spyw.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/836787
Signature
Contains functionality to compare user and computer (likely to detect sandboxes)
Detected unpacking (changes PE section rights)
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Clipboard Hijacker
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/375bc3e906ba184369288f6b09889fa45afeedc9529f86749e4b2dcd3af73b9f/
Threat name:
Win32.Trojan.Brook
Create hunting rule
Status:
Malicious
First seen:
2021-08-21 13:55:08 UTC
AV detection:
12 of 28 (42.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g5n4h2igximeg2jir5vqtce7urnp53ojkkpym5e6jmw42oxxhopq._file
Verdict:
unknown
Similar samples:
2542930821438d2ea9aa9b34ad96a1b23118e5c2987990d6608df7271879f6b4
Smoke Loader
2d7abc6173feb17ef4223fc045f35ed18607680b1844dfffcba70351d92626ce
Smoke Loader
42338f271984627fc7e5334f7d39077230b64c119068465e482ae6abdf97a1a7
Smoke Loader
4f1e3e4c9f9c97050c70fef47fb70cd39b2610da3a9b338660f88eeff2bfe158
Smoke Loader
662f58f0eb62731f52cf2cd2ffaa0933e175611f24e1d5f8e734d04dadc553ff
Smoke Loader
86d34c8a0dac58667e0fbed519b0189d90082825cba5721e9d3575c90c47e57c
Smoke Loader
878549ab9af1535e0791b8203d3d4baf96ee1e2e1f7925687092741f1014070d
Smoke Loader
87ac7b615a6bdc6ec0877f4c49ac696a8c782551d719586195d822cbecc8e0f9
Smoke Loader
d822b79bcbf0001dc173bce259e55de9a855bcfe469b337228f838f639c91db0
Smoke Loader
f160d5f2005b0d5a260e5a29f6b2c40a3caa53ce813ed92e62eb67ea92099acb
Smoke Loader
+ 367 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/210821-jxv5lexw6e/
Behaviour
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Executes dropped EXE
Unpacked files
SH256 hash:
19189d845acac54398888e27a66eb3771588bbde2080d3d3aab138053aee89e0
MD5 hash:
d850f8d4823240e54f834f85e09bd9e7
SHA1 hash:
2b7d73ebe87cf045464714074b06e756e788d05d
Link:
https://www.unpac.me/results/e15ce74a-d559-4a77-800b-0c7225f0c398/
SH256 hash:
375bc3e906ba184369288f6b09889fa45afeedc9529f86749e4b2dcd3af73b9f
MD5 hash:
f8d0489e9608a5f4bcc54a9ec542171b
SHA1 hash:
4a392aaef758ceb59f43b44882e531e6b257458d
Link:
https://www.unpac.me/results/e15ce74a-d559-4a77-800b-0c7225f0c398/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/375bc3e906ba184369288f6b09889fa45afeedc9529f86749e4b2dcd3af73b9f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_SmokeLoader
Create hunting rule
Author:ditekSHen
Description:Detects SmokeLoader variants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 375bc3e906ba184369288f6b09889fa45afeedc9529f86749e4b2dcd3af73b9f

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/181082/
  
URLhaus
https://urlhaus.abuse.ch/url/1551380/
  
Delivery method
Distributed via web download

Comments