MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 47ffcfc1a0233a7bcb0b4fc36d47f20d6c1293977cf489a6c39aed02f361af2c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 16


Intelligence 16 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 47ffcfc1a0233a7bcb0b4fc36d47f20d6c1293977cf489a6c39aed02f361af2c
SHA3-384 hash: d2c17efc3533b97af51ec25c95b8c8100d727517eb1a36d817fe8b851df9ab4a0aac65fc97b87509e4b66d2aee9c766f
SHA1 hash: 9214876f0d4d59ecc4514903987ed62995a0f255
MD5 hash: 0e2ade531fafeef8817b4694a6703439
humanhash: lactose-network-texas-oregon
File name:SecuriteInfo.com.Win32.PWSX-gen.20615.6677
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:201'216 bytes
First seen:2023-02-27 21:28:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7f54b7f04db8fcc4bbf55d4720df1540 (5 x Smoke Loader, 1 x TeamBot, 1 x RedLineStealer)
ssdeep 3072:auFOEmW3REou6E7lEWirnydZNYSoyG/MEpGq4aBKpy:HAE/3qou6E7cAZNz6Gq4a4s
Threatray 4'412 similar samples on MalwareBazaar
TLSH T1DC14AF1272A0DC71E57E1A329F2AC6F4262DFD119E685A5B33783B5F1DB02A1C1F2712
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 916a6a6a6a6a6a70 (19 x RedLineStealer, 18 x Smoke Loader, 3 x Amadey)
Reporter SecuriteInfoCom
Tags:exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
203
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
smoke
Create hunting rule
ID:
1
File name:
SecuriteInfo.com.Win32.PWSX-gen.20615.6677
Verdict:
Malicious activity
Analysis date:
2023-02-27 21:32:12 UTC
Tags:
trojan loader smoke
Link:
https://app.any.run/tasks/5a4fe792-cacd-4d99-a4f8-43410c8b21c1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
SmokeLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/370431/
Detection(s):
SecuriteInfo.com.Win32.PWSX-gen.20615.6677.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Sending an HTTP POST request
Searching for synchronization primitives
Query of malicious DNS domain
Unauthorized injection to a system process
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/63fd209f5d47c2515e80b264/reports/d946633b-cbb3-4156-8ec1-340e9fc88b3e/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/47ffcfc1a0233a7bcb0b4fc36d47f20d6c1293977cf489a6c39aed02f361af2c
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/eda440d3-c945-4b9e-afd4-6f13c069940a
Result
Threat name:
DanaBot, SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1183624
Signature
Antivirus detection for URL or domain
Benign windows process drops PE files
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected DanaBot stealer dll
Yara detected SmokeLoader
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 816455 Sample: SecuriteInfo.com.Win32.PWSX... Startdate: 27/02/2023 Architecture: WINDOWS Score: 100 110 Multi AV Scanner detection for domain / URL 2->110 112 Malicious sample detected (through community Yara rule) 2->112 114 Antivirus detection for URL or domain 2->114 116 5 other signatures 2->116 11 SecuriteInfo.com.Win32.PWSX-gen.20615.6677.exe 2->11         started        14 svibrss 2->14         started        16 FEF4.exe 2->16         started        process3 signatures4 136 Detected unpacking (changes PE section rights) 11->136 138 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 11->138 140 Maps a DLL or memory area into another process 11->140 18 explorer.exe 7 10 11->18 injected 142 Checks if the current machine is a virtual machine (disk enumeration) 14->142 144 Creates a thread in another existing process (thread injection) 14->144 23 conhost.exe 14->23         started        25 conhost.exe 16->25         started        process5 dnsIp6 94 187.232.163.204, 49693, 49695, 49696 UninetSAdeCVMX Mexico 18->94 96 2.180.10.7, 49686, 49694, 49698 TCIIR Iran (ISLAMIC Republic Of) 18->96 98 6 other IPs or domains 18->98 72 C:\Users\user\AppData\Roaming\svibrss, PE32 18->72 dropped 74 C:\Users\user\AppData\Local\Temp\FEF4.exe, PE32 18->74 dropped 76 C:\Users\user\AppData\Local\Temp\D70D.exe, PE32 18->76 dropped 78 2 other malicious files 18->78 dropped 118 System process connects to network (likely due to code injection or exploit) 18->118 120 Benign windows process drops PE files 18->120 122 Deletes itself after installation 18->122 124 Hides that the sample has been downloaded from the Internet (zone.identifier) 18->124 27 D70D.exe 4 18->27         started        31 1256.exe 1 18->31         started        33 FEF4.exe 18->33         started        file7 signatures8 process9 file10 88 C:\Users\user\AppData\Local\...\registers.exe, PE32 27->88 dropped 90 C:\Users\user\...\jujEIjVVnCCBgRmQ.exe, PE32+ 27->90 dropped 146 Machine Learning detection for dropped file 27->146 35 jujEIjVVnCCBgRmQ.exe 75 27->35         started        39 conhost.exe 27->39         started        41 conhost.exe 27->41         started        92 C:\Users\user\AppData\...\Qruhaepdediwhf.dll, PE32 31->92 dropped 148 Detected unpacking (changes PE section rights) 31->148 150 Detected unpacking (overwrites its own PE header) 31->150 43 rundll32.exe 31->43         started        signatures11 process12 dnsIp13 80 C:\Users\user\AppData\Local\...\win32ui.pyd, PE32+ 35->80 dropped 82 C:\Users\user\AppData\...\win32trace.pyd, PE32+ 35->82 dropped 84 C:\Users\user\AppData\...\win32security.pyd, PE32+ 35->84 dropped 86 69 other files (66 malicious) 35->86 dropped 126 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 35->126 128 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 35->128 130 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 35->130 134 4 other signatures 35->134 46 jujEIjVVnCCBgRmQ.exe 6 35->46         started        100 104.234.10.89 VELCOMCA Canada 43->100 102 142.11.244.14 HOSTWINDSUS United States 43->102 104 23.254.253.134 HOSTWINDSUS United States 43->104 132 System process connects to network (likely due to code injection or exploit) 43->132 file14 signatures15 process16 dnsIp17 106 192.168.2.1 unknown unknown 46->106 49 registers.exe 46->49         started        52 cmd.exe 46->52         started        54 cmd.exe 46->54         started        56 126 other processes 46->56 process18 signatures19 108 Tries to detect virtualization through RDTSC time measurements 49->108 58 conhost.exe 49->58         started        60 conhost.exe 52->60         started        62 conhost.exe 54->62         started        64 conhost.exe 56->64         started        66 conhost.exe 56->66         started        68 conhost.exe 56->68         started        70 119 other processes 56->70 process20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/47ffcfc1a0233a7bcb0b4fc36d47f20d6c1293977cf489a6c39aed02f361af2c/
Threat name:
Win32.Trojan.Vidar
Create hunting rule
Status:
Malicious
First seen:
2023-02-27 20:55:36 UTC
File Type:
PE (Exe)
Extracted files:
24
AV detection:
19 of 25 (76.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i7747qnaem5hxsylj7bw2r7sbvwbfe4xpt2itjwdtlwqf43bv4wa._file
Verdict:
malicious
Similar samples:
09ed41266242f1d86d54ea3902344cdc9b5852a57a918f0d01e178fcd92a66fa
Smoke Loader
253c30cb71da9048557691a67f05e87c83c103c691b27e17674805eb0aa08aed
Smoke Loader
31125dd90470955ca70e23ae2c3fd372db8b991a7c92bfb49d442b67539602c3
Smoke Loader
3b102b3148cc11c8590b804db1b651101263f829edb90180034a082b45ac6e3a
Smoke Loader
74d9950fb4a58f99306f9310d3bb295f865f164e16f2f53b6baec947ee5cfca5
Smoke Loader
8707dee63402e3a8dbf8b494caed17ea5632e07084837cd85823144a51ed7d0a
Smoke Loader
b54b7dd25042608209e2a84095f9f6cd3252024dfac84425916587a22e99d202
Smoke Loader
f26f96e09abbc77ca03bf7c1b884e455eb68f53c02854410ab5904802c92fed1
Smoke Loader
fec7e6d8626bf8373fbefecbdca920aa2b30ce8b94e65a78e16f042bbc9ab3e0
Smoke Loader
+ 4'402 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor pyinstaller trojan
Link:
https://tria.ge/reports/230227-1bwg1sfg92/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Detects Pyinstaller
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Blocklisted process makes network request
Downloads MZ/PE file
Detects Smokeloader packer
SmokeLoader
Malware Config
C2 Extraction:
http://vispik.at/tmp/
http://ekcentric.com/tmp/
http://hbeat.ru/tmp/
http://mordo.ru/tmp/
Unpacked files
SH256 hash:
10865df90c9008bcf408b793320729db7c09cd648c34f3dd87bb28e88f73f99e
MD5 hash:
8046419f924eafabb7ecf216e291b613
SHA1 hash:
bb646c4d7dfcae4a1e280aef21e11c0b36cf8ef0
Detections:
SmokeLoaderStage2
Create hunting rule
win_smokeloader_a2
Create hunting rule
Link:
https://www.unpac.me/results/7371c8e0-3653-4bc8-81ee-05b7fd69f177/
Parent samples :
74d9950fb4a58f99306f9310d3bb295f865f164e16f2f53b6baec947ee5cfca5
fabf60ba606f708c842b3cd143642c0ec9ac49b67678742b031abfe7e5f08ef8
fec7e6d8626bf8373fbefecbdca920aa2b30ce8b94e65a78e16f042bbc9ab3e0
820a71a15a01014165c73cb5ce0dfe7f44fb6c9016b88e7a360c0e20530e7f95
47ffcfc1a0233a7bcb0b4fc36d47f20d6c1293977cf489a6c39aed02f361af2c
fae6162b4e70c2dfda2bc89d93f1eff42cefcc0b5222959413dee0dd0d7d830f
SH256 hash:
47ffcfc1a0233a7bcb0b4fc36d47f20d6c1293977cf489a6c39aed02f361af2c
MD5 hash:
0e2ade531fafeef8817b4694a6703439
SHA1 hash:
9214876f0d4d59ecc4514903987ed62995a0f255
Link:
https://www.unpac.me/results/7371c8e0-3653-4bc8-81ee-05b7fd69f177/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/47ffcfc1a023/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/47ffcfc1a0233a7bcb0b4fc36d47f20d6c1293977cf489a6c39aed02f361af2c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 47ffcfc1a0233a7bcb0b4fc36d47f20d6c1293977cf489a6c39aed02f361af2c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2551827/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/370431/

Comments