MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38e72fcbf8f38717011e12623c232bd859a5dcc2b6a42f82d11a1649693e432a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 38e72fcbf8f38717011e12623c232bd859a5dcc2b6a42f82d11a1649693e432a
SHA3-384 hash: 42132ef9f3771fca26ba610f641507d1a041bf742faaac8817599e7aa71e53937d1f7b7d28de462ce5018e85446c25e7
SHA1 hash: f008ba62ef06097bb0894797f65dd5623553384f
MD5 hash: ce5e05759483f6055bce5b8274808de2
humanhash: nuts-march-high-oxygen
File name:ce5e05759483f6055bce5b8274808de2.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:318'464 bytes
First seen:2021-10-13 17:05:26 UTC
Last seen:2021-10-13 18:18:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e97201e7ef5f430ebcbaea94835aaebd (4 x Smoke Loader, 2 x RaccoonStealer, 1 x RedLineStealer)
ssdeep 6144:lsgmlpEWVOb92MvJywZipFvMl5I6LK5Zpl:+hlpEWVOx2MBCpFYI6Lw
Threatray 2'273 similar samples on MalwareBazaar
TLSH T15F647C10B7E0C039F5F316F95AB99368A93E7AA1AB2590CF12D416ED9734AD1EC30317
File icon (PE):PE icon
dhash icon aad8ac9cc6a68ee0 (34 x RedLineStealer, 14 x RaccoonStealer, 11 x Smoke Loader)
Reporter abuse_ch
Tags:Dofoil exe Smoke Loader

Intelligence

File Origin
# of uploads :
2
# of downloads :
268
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ce5e05759483f6055bce5b8274808de2.exe
Verdict:
Suspicious activity
Analysis date:
2021-10-13 19:59:54 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/d5cb87e8-8e43-43c1-a8f4-cf568af50903

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/197311/
Detection(s):
SecuriteInfo.com.Trojan.Siggen15.22687.20972.28328.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/616711fc1c2d58ba74050882/reports/e8556a76-fd09-45b3-ab1a-bbfd813387aa/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/827b67bc-bad1-467f-b9d6-b592ac710c63
Result
Threat name:
Raccoon RedLine SmokeLoader Tofsee Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/869855
Signature
.NET source code contains very large array initializations
Antivirus detection for URL or domain
Benign windows process drops PE files
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Contains functionality to steal Internet Explorer form passwords
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Detected VMProtect packer
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the windows firewall
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Performs DNS queries to domains with low reputation
Query firmware table information (likely to detect VMs)
Sigma detected: Copying Sensitive Files with Credential Data
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses netsh to modify the Windows network and firewall settings
Yara detected Costura Assembly Loader
Yara detected Raccoon Stealer
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Tofsee
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 502289 Sample: FTdhc25gn8.exe Startdate: 13/10/2021 Architecture: WINDOWS Score: 100 62 quadoil.ru 80.249.148.176, 443, 49808 SELECTELRU Russian Federation 2->62 64 microsoft-com.mail.protection.outlook.com 40.93.207.1, 25, 49803 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 2->64 66 13 other IPs or domains 2->66 80 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->80 82 Multi AV Scanner detection for domain / URL 2->82 84 Antivirus detection for URL or domain 2->84 86 17 other signatures 2->86 10 FTdhc25gn8.exe 2->10         started        13 acjifsw 2->13         started        15 svchost.exe 1 2->15         started        17 2 other processes 2->17 signatures3 process4 signatures5 96 Detected unpacking (changes PE section rights) 10->96 98 Contains functionality to inject code into remote processes 10->98 100 Injects a PE file into a foreign processes 10->100 19 FTdhc25gn8.exe 10->19         started        22 acjifsw 13->22         started        process6 signatures7 88 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 19->88 90 Maps a DLL or memory area into another process 19->90 92 Checks if the current machine is a virtual machine (disk enumeration) 19->92 24 explorer.exe 20 19->24 injected 94 Creates a thread in another existing process (thread injection) 22->94 process8 dnsIp9 68 wijibui0.xyz 24->68 70 192.162.246.70, 49772, 80 DATACHEAP-LLC-ASRU Russian Federation 24->70 72 5 other IPs or domains 24->72 44 C:\Users\user\AppData\Roaming\acjifsw, PE32 24->44 dropped 46 C:\Users\user\AppData\Local\Temp\B14A.exe, PE32 24->46 dropped 48 C:\Users\user\AppData\Local\Temp\A591.exe, PE32 24->48 dropped 50 14 other files (3 malicious) 24->50 dropped 102 System process connects to network (likely due to code injection or exploit) 24->102 104 Benign windows process drops PE files 24->104 106 Performs DNS queries to domains with low reputation 24->106 108 2 other signatures 24->108 29 154D.exe 47 24->29         started        34 B14A.exe 3 24->34         started        36 A591.exe 2 24->36         started        38 9748.exe 24->38         started        file10 signatures11 process12 dnsIp13 74 5.181.156.229, 49805, 80 MIVOCLOUDMD Moldova Republic of 29->74 76 telegatt.top 104.21.26.237, 49800, 80 CLOUDFLARENETUS United States 29->76 78 3 other IPs or domains 29->78 52 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 29->52 dropped 54 C:\Users\user\AppData\...\vcruntime140.dll, PE32 29->54 dropped 56 C:\Users\user\AppData\...\ucrtbase.dll, PE32 29->56 dropped 60 29 other files (none is malicious) 29->60 dropped 110 Detected unpacking (changes PE section rights) 29->110 112 Detected unpacking (overwrites its own PE header) 29->112 114 Tries to steal Mail credentials (via file access) 29->114 128 3 other signatures 29->128 116 Query firmware table information (likely to detect VMs) 34->116 118 Tries to detect sandboxes and other dynamic analysis tools (window names) 34->118 120 Hides threads from debuggers 34->120 122 Tries to detect sandboxes / dynamic malware analysis system (registry check) 34->122 40 conhost.exe 34->40         started        58 C:\Users\user\AppData\Local\...\jlfuqmiz.exe, PE32 36->58 dropped 124 Uses netsh to modify the Windows network and firewall settings 36->124 126 Modifies the windows firewall 36->126 42 9748.exe 38->42         started        file14 signatures15 process16
Detection:
redlinestealer
Create hunting rule
Link:
https://mwdb.cert.pl/sample/38e72fcbf8f38717011e12623c232bd859a5dcc2b6a42f82d11a1649693e432a/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-10-13 13:04:10 UTC
AV detection:
19 of 40 (47.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hdts7s7y6odroai6cjrdyizl3bm2lxgcw2sc7awrdiles2j6imva._file
Verdict:
malicious
Similar samples:
1561d6849d0b3394ab23968ba921e3c9af313ecf90cf2911b64889536c080dd4
Smoke Loader
323a27a7f2a664921d46c965f0c8d5977fb6c8fce20ba04e208c2945b7abdbba
Smoke Loader
49ad4fd1bd40286214edaee6edfa7ce8915b6bbd39758a4a93175f48626a478b
Smoke Loader
4eb02a90be27af84c49a2f62da8e179e5117d82db4e25c7a2c80e2954583bdb3
Smoke Loader
5c88ec7f348d5b457a2f155bbd9b0353c1cb840e0e971013c0ebc58aaee3b715
Smoke Loader
6ce593e9aa59ebf1c4e6763b626669a4d24a32dc1183b85c6586c8d949a9e024
Smoke Loader
8aeed198ba750585012a7dd45e68609523aebbb395c54e793ae69aa673b91774
Smoke Loader
9a7f4d4d2c440b8009781e82023e52e122d77c584ff7bef19002a29e3b918efd
Smoke Loader
a4b9e911a5f2f42c747161b858485001a041d5250b78bd80e80a78356797571f
Smoke Loader
f901f95b307d303778cafcb4b3158b8e4afd6b001c55461165fb55bd0c1fc29e
Smoke Loader
+ 2'263 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:arkei family:raccoon family:redline family:smokeloader family:tofsee family:vidar botnet:1033 botnet:1337b botnet:7ebf9b416b72a203df65383eec899dc689d2c3d7 botnet:@nastya_ero botnet:fbe5e97e7d069407605ee9138022aa82166657e6 botnet:huyzalupanew botnet:megaproliv2 botnet:w1 backdoor discovery evasion infostealer persistence spyware stealer themida trojan vmprotect
Link:
https://tria.ge/reports/211013-vmeezsefg3/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Windows directory
Launches sc.exe
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Checks BIOS information in registry
Deletes itself
Identifies Wine through registry keys
Loads dropped DLL
Reads user/profile data of web browsers
Themida packer
Windows security modification
Creates new service(s)
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
VMProtect packed file
Arkei Stealer Payload
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Nirsoft
Vidar Stealer
Arkei
Modifies Windows Defender Real-time Protection settings
Raccoon
RedLine
RedLine Payload
SmokeLoader
Suspicious use of NtCreateProcessExOtherParentProcess
Tofsee
Turns off Windows Defender SpyNet reporting
Vidar
Windows security bypass
Malware Config
C2 Extraction:
http://honawey7.xyz/
http://wijibui0.xyz/
http://hefahei6.xyz/
http://pipevai4.xyz/
http://nalirou7.xyz/
http://xacokuo8.xyz/
http://hajezey1.xyz/
http://gejajoo7.xyz/
http://sysaheu9.xyz/
http://rixoxeu9.xyz/
quadoil.ru
lakeflex.ru
https://mas.to/@oleg98
109.234.34.165:12323
45.14.49.66:21899
93.115.20.139:28978
135.181.208.162:13904
190.2.136.29:3279
Unpacked files
SH256 hash:
0fbcf23099387ae56cc0f680a137e881e4c50c01d8cdca9609af174ea48cce18
MD5 hash:
ca1628a7a671246efe77510431651e13
SHA1 hash:
65aba8a3a246cf4dc5ae20c7959e1885904553ce
Link:
https://www.unpac.me/results/32fdd20f-76ce-402b-bc3f-02c7010c10bd/
SH256 hash:
38e72fcbf8f38717011e12623c232bd859a5dcc2b6a42f82d11a1649693e432a
MD5 hash:
ce5e05759483f6055bce5b8274808de2
SHA1 hash:
f008ba62ef06097bb0894797f65dd5623553384f
Link:
https://www.unpac.me/results/32fdd20f-76ce-402b-bc3f-02c7010c10bd/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/38e72fcbf8f3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/38e72fcbf8f38717011e12623c232bd859a5dcc2b6a42f82d11a1649693e432a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 38e72fcbf8f38717011e12623c232bd859a5dcc2b6a42f82d11a1649693e432a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1660824/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1669848/
Cape
Cape
https://www.capesandbox.com/analysis/197311/

Comments