MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b8e18d982c1c1501a38913731cf546b6f214c66ef9a99a25ae1fd5b1dee78e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 18


Intelligence 18 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5b8e18d982c1c1501a38913731cf546b6f214c66ef9a99a25ae1fd5b1dee78e4
SHA3-384 hash: 58fa294ac4ac505c95f8f02200b5d067715e4dda4726782c03ebd0b1281466bd673f1b15f67a30ac41dcf4de24c708c5
SHA1 hash: 6ac556b4e91c7bce1f20874026df37c69b7de35d
MD5 hash: 928633fba2388fc690f4b61bcded9273
humanhash: single-finch-colorado-king
File name:86c01a451f671312f8448f5ad9f72f2d55f810e6e996bca7f9bce57d4b35d219_dump.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:41'369 bytes
First seen:2024-05-20 23:24:08 UTC
Last seen:2024-05-21 00:24:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 768:xIOvQlJqaTf6/WlaZFfhXtx4EpDtzpqBPHRvgkz:JvQXgxT5Xtx48tQZxvgkz
TLSH T19603D0178432FE6DC7D82BB250029B4E3BB879C7F01AA76940540E8EE0C9AD0DA17B65
TrID 42.6% (.EXE) Win32 Executable (generic) (4504/4/1)
19.2% (.EXE) OS/2 Executable (generic) (2029/13)
18.9% (.EXE) Generic Win/DOS Executable (2002/3)
18.9% (.EXE) DOS Executable Generic (2000/1)
0.2% (.VXD) VXD Driver (29/21)
Reporter ukycircle
Tags:exe Smoke Loader

Intelligence

File Origin
# of uploads :
2
# of downloads :
366
Origin country :
JP JP
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
5b8e18d982c1c1501a38913731cf546b6f214c66ef9a99a25ae1fd5b1dee78e4.exe
Verdict:
Malicious activity
Analysis date:
2024-05-20 23:25:34 UTC
Tags:
loader smokeloader
Link:
https://app.any.run/tasks/2044174e-3ed1-46ff-9929-81a2fed03047

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.Evo-gen.7152.26769.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Tags:
Encryption Static Xpack
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Connection attempt
Sending an HTTP POST request
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/664bdbd1d6e86aacd1cc96e6/reports/8ce958c8-879e-42dd-a011-4757ce49145e/overview
Verdict:
Malicious
Labled as:
Trojan.Heur.Generic
Link:
https://www.hybrid-analysis.com/sample/5b8e18d982c1c1501a38913731cf546b6f214c66ef9a99a25ae1fd5b1dee78e4
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/6767b01b-1cc4-4e1b-822b-24c0a2aa542b
Result
Threat name:
SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1444625
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1444625 Sample: 86c01a451f671312f8448f5ad9f... Startdate: 21/05/2024 Architecture: WINDOWS Score: 100 23 stayherefata4l.org 2->23 25 omfghellobrosjda38.org 2->25 27 masduh38sjdai.org 2->27 41 Snort IDS alert for network traffic 2->41 43 Found malware configuration 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 7 other signatures 2->47 7 86c01a451f671312f8448f5ad9f72f2d55f810e6e996bca7f9bce57d4b35d219_dump.exe 2->7         started        10 fihaejr 2->10         started        12 fihaejr 2->12         started        signatures3 process4 signatures5 49 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 7->49 51 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 7->51 53 Maps a DLL or memory area into another process 7->53 61 2 other signatures 7->61 14 explorer.exe 54 3 7->14 injected 55 Antivirus detection for dropped file 10->55 57 Multi AV Scanner detection for dropped file 10->57 59 Machine Learning detection for dropped file 10->59 process6 dnsIp7 29 omfghellobrosjda38.org 14->29 31 masduh38sjdai.org 158.160.169.85, 49736, 49737, 49739 DNIC-ASBLK-00721-00726US Venezuela 14->31 19 C:\Users\user\AppData\Roaming\fihaejr, PE32 14->19 dropped 21 C:\Users\user\...\fihaejr:Zone.Identifier, ASCII 14->21 dropped 33 System process connects to network (likely due to code injection or exploit) 14->33 35 Benign windows process drops PE files 14->35 37 Deletes itself after installation 14->37 39 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->39 file8 signatures9
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5b8e18d982c1c1501a38913731cf546b6f214c66ef9a99a25ae1fd5b1dee78e4
Detection:
smokeloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5b8e18d982c1c1501a38913731cf546b6f214c66ef9a99a25ae1fd5b1dee78e4/
Threat name:
Win32.Trojan.SmokeLoader
Create hunting rule
Status:
Malicious
First seen:
2024-05-20 23:25:06 UTC
File Type:
PE (Exe)
AV detection:
22 of 23 (95.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lohbrwmcyhavagryse3tdt2unnxsctdg56njtis24h6vwhpopdsa._file
Verdict:
malicious
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader botnet:rbrn backdoor trojan
Link:
https://tria.ge/reports/240520-3d95asah74/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Uses Task Scheduler COM API
Deletes itself
SmokeLoader
Malware Config
C2 Extraction:
http://stayherefata4l.org/index.php
http://masduh38sjdai.org/index.php
http://omfghellobrosjda38.org/index.php
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/2842da54-5492-4ec1-acb8-c80b4ee5cf8f
Unpacked files
SH256 hash:
5b8e18d982c1c1501a38913731cf546b6f214c66ef9a99a25ae1fd5b1dee78e4
MD5 hash:
928633fba2388fc690f4b61bcded9273
SHA1 hash:
6ac556b4e91c7bce1f20874026df37c69b7de35d
Detections:
SmokeLoaderStage2
Create hunting rule
win_smokeloader_a2
Create hunting rule
Link:
https://www.unpac.me/results/5f0f28bb-8748-4b33-aaf0-64ec46308d20/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5b8e18d982c1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5b8e18d982c1c1501a38913731cf546b6f214c66ef9a99a25ae1fd5b1dee78e4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh

Comments