MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41582c8b6bd111a2f141dee52b619d13278ef68754691263abeb3238d485f404. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 18

Intelligence 18 IOCs YARA 2 File information Comments

SHA256 hash:	41582c8b6bd111a2f141dee52b619d13278ef68754691263abeb3238d485f404
SHA3-384 hash:	84e3a5b54cc1d2bcc9d3e6a4012e0c1958bbde8e780894c1326632d8ebb976f5708a5542adbc080ed0b574728ce50861
SHA1 hash:	7bf6d4d00326ecfa3e48644896d3407ab473a9d5
MD5 hash:	d78d85135f584e455f692923d9feb804
humanhash:	quiet-freddie-mountain-venus
File name:	file
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	358'912 bytes
First seen:	2024-08-23 20:58:35 UTC
Last seen:	2024-08-23 21:30:41 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	50cdf2182ca720de32fbafe8cf1efc71 (1 x Smoke Loader)
ssdeep	6144:gSVu917CQaNutVHcaOLnysBBPEDcu4jZ21sK0O:gSE91m7WSasBPu6Z2z
TLSH	T15B74E13172B08CB6D5B21E704870CB9D5A3A7C136AB4998F33D42E5E5F7138299A435F
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
File icon (PE):
dhash icon	1a72c2da98585c0c (16 x Stealc, 3 x Smoke Loader, 2 x Vidar)
Reporter	Bitsight
Tags:	exe Smoke Loader

Bitsight

url: http://154.216.18.223/setup2.exe

Intelligence

File Origin

# of uploads :

# of downloads :

418

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

file

Verdict:

Malicious activity

Analysis date:

2024-08-23 20:59:18 UTC

Tags:

loader smokeloader evasion stealer

Link:

https://app.any.run/tasks/6813e9b7-f4b7-4b45-a985-1f82cec416f5

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Packer.pkr_ce1a-9980177-0

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66c8f817e7ff3f5a063bd136

Tags:

Discovery Network Stealth Outsteel

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Connection attempt to an infection source

Query of malicious DNS domain

Unauthorized injection to a system process

Enabling autorun by creating a file

Sending an HTTP POST request to an infection source

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

epmicrosoft_visual_cc microsoft_visual_cc packed

Link:

https://www.filescan.io/uploads/66c8f8173f7da47801678731/reports/33499f05-1d4c-46ef-9255-9fcb86da1ff3/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/41582c8b6bd111a2f141dee52b619d13278ef68754691263abeb3238d485f404

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/67057655-56d6-46b9-81eb-51c78a25d30d

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1498250

Signature

AI detected suspicious sample

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/41582c8b6bd111a2f141dee52b619d13278ef68754691263abeb3238d485f404

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/41582c8b6bd111a2f141dee52b619d13278ef68754691263abeb3238d485f404/

Threat name:

Win32.Trojan.Smokeloader

Status:

Malicious

First seen:

2024-08-23 19:17:47 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 24 (100.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ifmczc3l2ei2f4kb33sswym5cmty55uhkrurey5l5mzdrvef6qca._file

Verdict:

malicious

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader botnet:pub2 backdoor discovery trojan

Link:

https://tria.ge/reports/240823-zsp6wsybmn/

Behaviour

Checks SCSI registry key(s)

Program crash

System Location Discovery: System Language Discovery

SmokeLoader

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/04d605f3-1903-49a8-a3cd-23bc3e7b3d12

Unpacked files

SH256 hash:

977646f31a879d2ddd9938e2f39a74653556fd970dd2fa6172f26348d18622dc

MD5 hash:

8ee858716125555e7355a2b919417a53

SHA1 hash:

20a3bfa728fe21f18f6c4f8c17c01e4bd416063e

Detections:

SmokeLoaderStage2

win_smokeloader_a2

Link:

https://www.unpac.me/results/85cf278b-cac0-4bd5-b89a-f3a2fc3f31b3/

Parent samples :

3ec76b58400fa83602d35d82f38341d921223dcdf175b98bca435a59ba340464
d3e138b03be305d34d6ee21c5f4cc4d496ff447601ffb71508e23e580bd50e7c
edf20ee240507ae1f49a20f8d20deee11484c013150d6d57ae1fe8ff69e0f8d5
e75102f75f478c346b1dd2ebd56311a9d7345d3c785a6b2dc2911033a317c485
d1abb50ea4d533a3e57b99e347d5d8675896ce23576987edcc9c3426ffb0c380
acc17deb417db03958118c1ac08156e0fca081605b909644523dd3fa887cf674
88b5ed74d4fc6f2cf6394bd1766f44df61e7dc9b810cfacbecba5b34af3bf57d
76ba1d82e20b13b9d1becbb799aa68f6539092f6823f38a86ce935b0650b0556
41582c8b6bd111a2f141dee52b619d13278ef68754691263abeb3238d485f404
1c1d81eaf1a389d4dafc6ba71a3e3bfaa477a49b4d3591956cab660165648028
1415378411d7d155dd8217cdc7e453dc221219b2432473d110ea65368f58f095

SH256 hash:

41582c8b6bd111a2f141dee52b619d13278ef68754691263abeb3238d485f404

MD5 hash:

d78d85135f584e455f692923d9feb804

SHA1 hash:

7bf6d4d00326ecfa3e48644896d3407ab473a9d5

Link:

https://www.unpac.me/results/85cf278b-cac0-4bd5-b89a-f3a2fc3f31b3/

Malware family:

SmokeLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/41582c8b6bd1/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/41582c8b6bd111a2f141dee52b619d13278ef68754691263abeb3238d485f404

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

exe 41582c8b6bd111a2f141dee52b619d13278ef68754691263abeb3238d485f404

(this sample)

Dropped by

Amadey

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/3112840/

URLhaus

https://urlhaus.abuse.ch/url/3125028/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::SetProcessShutdownParameters KERNEL32.dll::OpenSemaphoreA KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetStartupInfoW KERNEL32.dll::GetDiskFreeSpaceExA KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::PeekConsoleInputW KERNEL32.dll::SetConsoleCP KERNEL32.dll::SetConsoleWindowInfo KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleAliasExesA KERNEL32.dll::GetConsoleAliasExesLengthA KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateHardLinkW KERNEL32.dll::CreateFileMappingW KERNEL32.dll::CreateFileW KERNEL32.dll::GetFileAttributesA KERNEL32.dll::SetVolumeMountPointW KERNEL32.dll::SetVolumeMountPointA
WIN_BASE_USER_API	Retrieves Account Information	KERNEL32.dll::QueryDosDeviceA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample