MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 57290220f611832cbc11c8b6d4929f1dcb585cb5a4c1b2833dca53c04fe072ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gozi

Vendor detections: 9

Intelligence 9 IOCs YARA File information Comments

SHA256 hash:	57290220f611832cbc11c8b6d4929f1dcb585cb5a4c1b2833dca53c04fe072ba
SHA3-384 hash:	2ba62827ab5ad1fa7b0b2022dbc1be47c4a9b02a3e6f6093ee7c408c9b633b40a984dec4048576d7eb04044a367fb183
SHA1 hash:	b77da5f4d7ff41af7a57c9cfa58338536f475b72
MD5 hash:	e7278f65e590909ee6d487a51c921bed
humanhash:	berlin-blossom-cup-alaska
File name:	4ctt1.exe
Download:	download sample
Signature	Gozi Create hunting rule
File size:	238'592 bytes
First seen:	2021-03-26 15:11:06 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	19a26fa1d4f67c66683ae2e4fe20653b (2 x Gozi)
ssdeep	6144:f1qCZP3EBVhn/HHr1wGTDzryWIVRIK73I:o+P3EBVhn/HHr3HzrdMRV3
Threatray	2'003 similar samples on MalwareBazaar
TLSH	BC347D00AFA0C038F1BBD1F4597993E8F929BAB05F2441CB62D55AEE56386F09C39717
Reporter	nao_sec
Tags:	RigEK SmokeLoader

Intelligence

File Origin

# of uploads :

# of downloads :

248

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

https://ankltrafficexit.xyz/trafficexit

Verdict:

Malicious activity

Analysis date:

2021-03-26 14:58:09 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/4b4870d4-4290-4b65-9287-9e2e77db9f52

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/127063/

Detection(s):

Win.Malware.Generic-9846132-0

Win.Packed.Razy-9847307-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Sending a UDP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Connection attempt

Sending an HTTP POST request

Connection attempt to an infection source

Deleting of the original file

Enabling autorun by creating a file

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Gathering data

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/655723

Signature

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Renames NTDLL to bypass HIPS

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/57290220f611832cbc11c8b6d4929f1dcb585cb5a4c1b2833dca53c04fe072ba/

Threat name:

Win32.Infostealer.Recealer

Status:

Malicious

First seen:

2021-03-21 21:35:24 UTC

AV detection:

27 of 29 (93.10%)

Threat level:

5/5

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor trojan

Link:

https://tria.ge/reports/210326-a9ekexqy12/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of UnmapMainImage

Deletes itself

Loads dropped DLL

SmokeLoader

Malware Config

C2 Extraction:

http://etasuklavish.today/
http://mragyzmachnobesdi.today/
http://kimchinikuzims.today/
http://slacvostinrius.today/
http://straponuliusyn.today/
http://grammmdinss.today/
http://viprasputinsd.chimkent.su/
http://lupadypa.dagestan.su/
http://stoknolimchin.exnet.su/
http://musaroprovadnikov.live/
http://teemforyourexprensiti.life/
http://stolkgolmishutich.termez.su/
http://roompampamgandish.wtf/