MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5074213bdad4f70a772ff9da9ef5d64d5ebdb1b85f894c82523f75cc8dee9903. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 7

Intelligence 7 IOCs YARA File information Comments

SHA256 hash:	5074213bdad4f70a772ff9da9ef5d64d5ebdb1b85f894c82523f75cc8dee9903
SHA3-384 hash:	989035e1555b78f58b96fea374eaf2f78258f14aa5a2c54d60c4d8dac2415f2c56dee37900418665a2387a7568d4553b
SHA1 hash:	7e241a390ba4225cb7284a3f4c3508984c2b7b3b
MD5 hash:	e56fcd770011e421671e0139c91c5a1f
humanhash:	sodium-minnesota-west-crazy
File name:	e56fcd770011e421671e0139c91c5a1f.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	227'328 bytes
First seen:	2021-08-09 11:32:52 UTC
Last seen:	2021-08-09 13:06:12 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	e167d9e0823b3034f406b282c3e2b91c (3 x RedLineStealer, 3 x Smoke Loader, 2 x RaccoonStealer)
ssdeep	3072:dX27T0PT4uG2tgnIIXNi5u+7YWnWnCNeoBOUL+48F10b:RX4uG2tgnbNdhWWCIwK7/
Threatray	4'214 similar samples on MalwareBazaar
TLSH	T112249E317680F876E5570730749E9BA4FB69EC206BE1424B37593F2E6E333C0176A256
dhash icon	1036787872767636 (3 x RaccoonStealer, 2 x ArkeiStealer, 2 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

120

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

e56fcd770011e421671e0139c91c5a1f.exe

Verdict:

No threats detected

Analysis date:

2021-08-09 11:38:12 UTC

Tags:

installer

Link:

https://app.any.run/tasks/ceb405fe-99ac-4a80-b496-706775b80e26

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/177534/

Detection(s):

SecuriteInfo.com.Trojan.DownLoader41.8044.5135.1704.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending a UDP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Connection attempt

Sending an HTTP POST request

Creating a process from a recently created file

Deleting of the original file

Enabling autorun by creating a file

Unauthorized injection to a system process

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

DanaBot

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8456c2d2-133f-4075-bff4-1832281d28a6

Result

Threat name:

RedLine SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/829254

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Uses known network protocols on non-standard ports

Yara detected RedLine Stealer

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5074213bdad4f70a772ff9da9ef5d64d5ebdb1b85f894c82523f75cc8dee9903/

Threat name:

Win32.Trojan.Azorult

Status:

Malicious

First seen:

2021-08-09 09:31:38 UTC

AV detection:

19 of 28 (67.86%)

Threat level:

5/5

Verdict:

unknown

Smoke Loader

26e94627a3abe752072319b8eca4f68029a27090f89de5b92d4f700fc0f4f0b2

Smoke Loader

302945194f1ff6faa74375b03943a4474a1ba9baa33edb3264b83254acb0028a

Smoke Loader

392e2fc8bcf20d142620a90de7cc2632e86771a38db9b2a67a8809935ef97752

Smoke Loader

3d93d1e45579a47c3a3425fd16319c5a004396a2d98b7cf170ed009dad29c247

Smoke Loader

4958d08fea2f261b0d2208047191e970454f48d951da411a9f665f105e298e93

Smoke Loader

4b71a9679c72bbf0c14e8c13393e5b11c0c4878ef6a878c2843152a3a3498459

Smoke Loader

7e05f4642d1de973d7f93938f049de28d6e544ad1eb3729de2a9cb027d46f881

Smoke Loader

902f92bdbd5dbdd9534149faa18b00d8b983665820427480c93bead483f32c92

Smoke Loader

96aac7055ae44874e1c2b1366f10af0cdf252af25c93eb46f4b05c9717f39de5

Smoke Loader

+ 4'204 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:redline family:smokeloader botnet:sewpalpadin backdoor infostealer trojan

Link:

https://tria.ge/reports/210809-he4tkpzjpn/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Deletes itself

Downloads MZ/PE file

Executes dropped EXE

RedLine

RedLine Payload

SmokeLoader

Malware Config

C2 Extraction:

http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
185.215.113.114:8887