MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 550e4267d7c73ab5a829721af8699f3b629865841f0feaf512e6048cb85fc604. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 14

Intelligence 14 IOCs YARA File information Comments

SHA256 hash:	550e4267d7c73ab5a829721af8699f3b629865841f0feaf512e6048cb85fc604
SHA3-384 hash:	dd6e0e4e9c391430eac6322db39c8c4df0f6da00ca554d99c8ea450f107357f084a399ec8b5a541bc312ab8382c6f868
SHA1 hash:	757e7ead7f7ac618e13d74e40338448336794de3
MD5 hash:	88efe3b315749f26e060075c0defad08
humanhash:	triple-tennis-berlin-happy
File name:	88efe3b315749f26e060075c0defad08.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	193'024 bytes
First seen:	2021-12-13 17:08:20 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	7f4d3b921ad5f29f447de130848647e5 (21 x RedLineStealer, 3 x Smoke Loader, 1 x ArkeiStealer)
ssdeep	3072:8t0BOM/axZp0iPIb75GcyAx/qnU59sohsZVggjcGkNIVqIZh2:FH/axZp0iPXJAxMTb7ITsqB
TLSH	T153148CC175D0D7F1D6A33970B860AAA45E7BFCADDA20444B327827AE2F7E3C05925352
File icon (PE):
dhash icon	fcfcb4d4d4d4d8c8 (18 x RedLineStealer, 10 x RaccoonStealer, 5 x Smoke Loader)
Reporter	abuse_ch
Tags:	Dofoil exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

293

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

88efe3b315749f26e060075c0defad08.exe

Verdict:

Suspicious activity

Analysis date:

2021-12-13 17:23:18 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/d7e7caa0-60d9-41c4-92d0-23a7306d0a0b

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/213635/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Unauthorized injection to a recently created process

Searching for synchronization primitives

DNS request

Сreating synchronization primitives

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Sending an HTTP GET request

Creating a file in the %temp% directory

Creating a process from a recently created file

Query of malicious DNS domain

Unauthorized injection to a system process

Enabling autorun by creating a file

Sending an HTTP POST request to an infection source

Result

Malware family:

n/a

Score:

9/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/1796/overview

Behaviour

MalwareBazaar

MeasuringTime

CPUID_Instruction

SystemUptime

EvasionQueryPerformanceCounter

CheckCmdLine

EvasionGetTickCount

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/61b77e324b267126def1cc41/reports/ed52b332-d9dc-4dd7-9842-3dd6b4b3001a/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/36abbca4-95d0-4d62-ab3a-1f7ad96517f8

Result

Threat name:

RedLine SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/906488

Signature

.NET source code contains method to dynamically call methods (often used by packers)

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Hides threads from debuggers

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file has nameless sections

Query firmware table information (likely to detect VMs)

Sigma detected: Execution Of Other File Type Than .exe

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to evade analysis by execution special instruction which cause usermode exception

Yara detected RedLine Stealer

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/550e4267d7c73ab5a829721af8699f3b629865841f0feaf512e6048cb85fc604/

Threat name:

Win32.Trojan.Azorult

Status:

Malicious

First seen:

2021-12-12 20:15:39 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

25 of 28 (89.29%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kuheez6xy45llkbjoinpq2m7hnrjqzmed4h6v5is4ycizoc7yyca._file

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:arkei family:raccoon family:redline family:smokeloader botnet:9ea5fe19c17f2e278d5c0d9536978c9866e2383e backdoor collection infostealer stealer trojan

Link:

https://tria.ge/reports/211213-vn422adhf4/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Deletes itself

Loads dropped DLL

Downloads MZ/PE file

Executes dropped EXE

Arkei Stealer Payload

Arkei

Raccoon

RedLine

RedLine Payload

SmokeLoader

Malware Config

C2 Extraction:

http://host-data-coin-11.com/
http://file-coin-host-12.com/
http://srtuiyhuali.at/
http://fufuiloirtu.com/
http://amogohuigotuli.at/
http://novohudosovu.com/
http://brutuilionust.com/
http://bubushkalioua.com/
http://dumuilistrati.at/
http://verboliatsiaeeees.com/