MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4564475353ab3f0d5e9200009b3e8f0ab950dd140720a8ac3ecd054b80b9cf8f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 8

Intelligence 8 IOCs YARA File information Comments

SHA256 hash:	4564475353ab3f0d5e9200009b3e8f0ab950dd140720a8ac3ecd054b80b9cf8f
SHA3-384 hash:	1707b159b0919c3b850215fa4095690a79e5955e2ffb920faa0f30aceaf35056c226b0c4212c24145145d70f98b510bf
SHA1 hash:	9d4c5dc49c0d24e244090f38a87af186163fcd14
MD5 hash:	716e808961c26085303b90cedec7ae17
humanhash:	zulu-vermont-alaska-shade
File name:	716e808961c26085303b90cedec7ae17.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	150'528 bytes
First seen:	2021-08-20 15:02:37 UTC
Last seen:	2021-08-20 16:12:13 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	a84fa8c5c9d81b30cf439f0d2b7f422b (7 x RedLineStealer, 4 x RaccoonStealer, 2 x Smoke Loader)
ssdeep	3072:HpHSh0hXk6HfgLp+1iReblGYeazgFnLmx:1ShP6H4d+5JeYgFnL
Threatray	5'113 similar samples on MalwareBazaar
TLSH	T17FE3AE1034F0F5B2C4550D3398908BA0D63AE865FF7542473E6F275E1E2D2D0DA2AFAA
dhash icon	1072c092b0381902 (9 x RedLineStealer, 9 x RaccoonStealer, 4 x CryptBot)
Reporter	abuse_ch
Tags:	exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

133

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

716e808961c26085303b90cedec7ae17.exe

Verdict:

No threats detected

Analysis date:

2021-08-20 15:06:23 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/b08af84e-c2bf-489d-a2af-25290877fd87

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/180978/

Detection(s):

SecuriteInfo.com.Variant.Fragtor.9685.6537.31323.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Sending a UDP request

Connection attempt

Sending an HTTP POST request

Creating a process from a recently created file

Deleting of the original file

Enabling autorun by creating a file

Unauthorized injection to a system process

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

DanaBot

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/1cf36334-c940-4a91-97fb-786f96fd8900

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/836524

Signature

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4564475353ab3f0d5e9200009b3e8f0ab950dd140720a8ac3ecd054b80b9cf8f/

Threat name:

Win32.Trojan.Fragtor

Status:

Malicious

First seen:

2021-08-20 15:03:06 UTC

AV detection:

22 of 28 (78.57%)

Threat level:

5/5

Verdict:

unknown

Smoke Loader

256ad361e3b197d08e734c3d116ae1311045cc11a9f7f7be4994ad9fb46a0ca0

Smoke Loader

3b15547e53d7254ec42974dc5a1d7b72cffd722a41114944b5606a845be7b76d

Smoke Loader

45d0060ff892ad4d258a44d245120126ace469a5aa256e36f1d28b5506ac8ec8

Smoke Loader

786011dec9484fb81863be557b51a2adba291cee4cc6c6f91fd21c2ce94cb1a8

Smoke Loader

8a0c92492986fc6dde9450672a3f76d05beee65f95b997a7866c7bba341bbaa2

Smoke Loader

8a9f3452db181e6a402c1c2b5f4848c657535bf94572a12eee70a57721f9931b

Smoke Loader

b46fa39b04cb5928c3dd9c1bbcbd9008401d98faff5e42115102b00c60fbd486

Smoke Loader

b817002c69c6315e116f14d6fe64151577999eb773842f052fb17d9a7413a53c

Smoke Loader

d775f62d097e069293b27267d7efd95862e55e7ecc5e23e9c3ea532c39321b0e

Smoke Loader

+ 5'103 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor discovery persistence trojan

Link:

https://tria.ge/reports/210820-ld9hfnhmgn/

Behaviour

Checks SCSI registry key(s)

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Adds Run key to start application

Looks up external IP address via web service

Deletes itself

Loads dropped DLL

Modifies file permissions

Downloads MZ/PE file

Executes dropped EXE

SmokeLoader

Malware Config

C2 Extraction:

http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/