MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56ae4932aafb8ed85c51038e2f003e829addf08a197890c8989bf0bdc51e7f49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 56ae4932aafb8ed85c51038e2f003e829addf08a197890c8989bf0bdc51e7f49
SHA3-384 hash: 6deafb4f561ef293d49d9e40c0228c494530deb0bc5f01b07ffd7eda7847bcd8959cca797cc12ed59582d1407fb02a3c
SHA1 hash: 105406f798f7b8a0b8532a64ad9061e5ae447cdc
MD5 hash: 435d4757bcfe29c1f1ea289a2566a3ed
humanhash: mars-beer-alpha-oklahoma
File name:SecuriteInfo.com.W32.AIDetect.malware1.32537.18714
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:344'576 bytes
First seen:2021-10-10 21:55:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d8470aebc2200bafc1ff60318f406103 (4 x Smoke Loader, 2 x ArkeiStealer, 1 x RedLineStealer)
ssdeep 6144:7+lBHzxPyoHMtCeXjxMUa0PNFOOIefACagyZ8lcKJl8bwblpYL:yf1PywqCeXjxMUzPCOIefACagyZ8lcKh
Threatray 5'015 similar samples on MalwareBazaar
TLSH T1FF748E00B7E0C035F6F316F949B992A8A93E7DA55B2990DF52C0EADE56346E1EC31307
File icon (PE):PE icon
dhash icon 9824e7d0c4e7215c (11 x RedLineStealer, 5 x Smoke Loader, 2 x RaccoonStealer)
Reporter SecuriteInfoCom
Tags:exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
202
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.W32.AIDetect.malware1.32537.18714
Verdict:
No threats detected
Analysis date:
2021-10-10 21:57:27 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/2c2b8f4f-71cd-4b86-9fb0-8ca75d44989e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/196416/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.32537.18714.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching the default Windows debugger (dwwin.exe)
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware packed stop
Link:
https://www.filescan.io/uploads/616361773831960005b351d9/reports/98933537-8966-4f23-94ca-b6851a946b45/overview
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/56ae4932aafb8ed85c51038e2f003e829addf08a197890c8989bf0bdc51e7f49/
Threat name:
Win32.Trojan.Sabsik
Create hunting rule
Status:
Malicious
First seen:
2021-10-10 19:31:14 UTC
AV detection:
15 of 45 (33.33%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
06051cf2934898bcc716b95d1a9f131d724fafc0425a4745d5546d3d6b9fc027
Smoke Loader
296cb7c456c55688de080e9940722307f1ee92acbfec61696e21ec985794a3ff
Smoke Loader
5e1a4b9ced78b15872e2723b231e3934c4874c6ea28ebf6c983a61f5040b5f96
Smoke Loader
91949edb9145bda3b1336a5513c44707a86300ca5a378411c9bf8800b8127db9
Smoke Loader
9f154115fa8045aa05f15f7cd1de9623ebe32e8ea400279ecb5dfa3596952e3b
Smoke Loader
dcf60583940d9683d950022fc0ff511ea3a7364b728635eb904d28460200dd98
Smoke Loader
e0caf6fb02b0ef2bd64b0e04e1793a502b4a3b350a5be41c1baea88842530383
Smoke Loader
edf6beb88780fb3085332f843b73418f52bbf095265dad631cf8e187644cb565
Smoke Loader
+ 5'005 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:redline family:smokeloader botnet:new botnet:new1 agilenet backdoor discovery infostealer spyware stealer suricata trojan
Link:
https://tria.ge/reports/211010-1tc4dsgben/
Behaviour
Checks SCSI registry key(s)
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Deletes itself
Loads dropped DLL
Obfuscated with Agile.Net obfuscator
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
RedLine
RedLine Payload
SmokeLoader
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
Malware Config
C2 Extraction:
http://gmpeople.com/upload/
http://mile48.com/upload/
http://lecanardstsornin.com/upload/
http://m3600.com/upload/
http://camasirx.com/upload/
45.9.20.107:46187
45.140.146.88:57313
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/56ae4932aafb/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/56ae4932aafb8ed85c51038e2f003e829addf08a197890c8989bf0bdc51e7f49

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 56ae4932aafb8ed85c51038e2f003e829addf08a197890c8989bf0bdc51e7f49

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1664470/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/196416/

Comments