MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d0216195e3a4016f0adc0d286e2f78c78188068af9ff28d8d9a2b09634cd2fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d0216195e3a4016f0adc0d286e2f78c78188068af9ff28d8d9a2b09634cd2fa
SHA3-384 hash: 4e0c5b9c60f45d9864acc7a66be5bd8b25630d5032933f94f3fed6c4e472ca5191a8624182dc8a7fd6f10e8b85fa2506
SHA1 hash: c8275dedafaaf6ab3866b0e1024c94d9b3035b04
MD5 hash: 59365da5404ac5b36fc5a503b25490c4
humanhash: illinois-friend-sink-delta
File name:59365da5404ac5b36fc5a503b25490c4.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:310'784 bytes
First seen:2021-08-14 07:00:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash cc12335fcaf380223f708d3b30304b0a (7 x RaccoonStealer, 4 x RedLineStealer, 1 x ArkeiStealer)
ssdeep 6144:fF2/WN3Pbl2QnUsQhCcwp6C18ygoj3se+ntRhyvmoJ6oR:A/WNPAQnihCl18yg6KEmoJvR
Threatray 404 similar samples on MalwareBazaar
TLSH T1EF648D30B790C434E9B6D1F885AA937CA4297E615B3450CF52E526FE5A343E8EC3079B
dhash icon d824e790c4e72158 (30 x RaccoonStealer, 18 x RedLineStealer, 16 x Smoke Loader)
Reporter abuse_ch
Tags:exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
176
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
59365da5404ac5b36fc5a503b25490c4.exe
Verdict:
Malicious activity
Analysis date:
2021-08-14 07:10:01 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/73252155-d5d7-42ec-99ea-d0ad6f635b73

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/179189/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader41.11497.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %AppData% subdirectories
Launching a process
Sending a custom TCP request
Sending a UDP request
Creating a process from a recently created file
Enabling autorun by creating a file
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
DanaBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5c82e20a-0cec-4749-add0-3ec16b686751
Result
Threat name:
Clipboard Hijacker
Create hunting rule
Detection:
malicious
Classification:
spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/832796
Signature
Contains functionality to compare user and computer (likely to detect sandboxes)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Clipboard Hijacker
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5d0216195e3a4016f0adc0d286e2f78c78188068af9ff28d8d9a2b09634cd2fa/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-08-14 05:31:05 UTC
AV detection:
17 of 46 (36.96%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
14e4824be0683d1089694045fb18bfef2da645ab2c4c8b07158894e9d9ec2a1b
Smoke Loader
5978984d7f8a80cba8b94b3e4e973eeb6218f82535ea8e55aca5deb8830afc2c
Smoke Loader
64c1dfd4d78c54982f2908ecb8a61479adb6dd75a68c2ace5617d9a8de482298
Smoke Loader
69e4ff507f7cd44f44cf6ee29637b202485ad5d1b3358168d68b8b95e00351b7
Smoke Loader
76c2e3afa7f0a8f45c84517763a838292b92768e88c7c801f2b8e8ef2381e907
Smoke Loader
806ed2c49bd059dced46432ab56ba22b0a79af0933d999ce86ee95507b9009b8
Smoke Loader
9dc0631ea1726b49d0e25b634b6e57253951088f4d007b00407118fcd82fa272
Smoke Loader
d0e8d7a631a88b4a1e213be9d37a104469fa2217df5853cc5070ed50a5790c7d
Smoke Loader
d1c619e1afe873b97c09c8068b30efcaafffbfdfb0dce63cad7f1a8394e260a8
Smoke Loader
e02eee1586a84d7d556d451ae08a9a0fb39d14e5f9dcc51102439e030fec3a70
Smoke Loader
+ 394 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/210814-fe9h2gswkj/
Behaviour
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Executes dropped EXE
Unpacked files
SH256 hash:
19189d845acac54398888e27a66eb3771588bbde2080d3d3aab138053aee89e0
MD5 hash:
d850f8d4823240e54f834f85e09bd9e7
SHA1 hash:
2b7d73ebe87cf045464714074b06e756e788d05d
Link:
https://www.unpac.me/results/f04155b4-9202-47dc-a787-8fa32a5853c4/
SH256 hash:
5d0216195e3a4016f0adc0d286e2f78c78188068af9ff28d8d9a2b09634cd2fa
MD5 hash:
59365da5404ac5b36fc5a503b25490c4
SHA1 hash:
c8275dedafaaf6ab3866b0e1024c94d9b3035b04
Link:
https://www.unpac.me/results/f04155b4-9202-47dc-a787-8fa32a5853c4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5d0216195e3a4016f0adc0d286e2f78c78188068af9ff28d8d9a2b09634cd2fa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_SmokeLoader
Create hunting rule
Author:ditekSHen
Description:Detects SmokeLoader variants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 5d0216195e3a4016f0adc0d286e2f78c78188068af9ff28d8d9a2b09634cd2fa

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1524258/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/179189/

Comments