MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e30a88fb1c9a45bd6697990493098ca05e87b2560172ae89e9811ea887ff8b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5e30a88fb1c9a45bd6697990493098ca05e87b2560172ae89e9811ea887ff8b4
SHA3-384 hash: b25eb3115d57d559ac7f818704b22e62a5eeaf2210c752d7286ffbfb404c90591adf80f4c1a4e3854d0c711bc9936bb9
SHA1 hash: 23ad080a2663d7dfc74ba5ec65d0a898497f255c
MD5 hash: 1d2b13ca8358bc5ddb5259b21d54c58b
humanhash: solar-louisiana-apart-fish
File name:1d2b13ca8358bc5ddb5259b21d54c58b.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:194'560 bytes
First seen:2021-07-14 15:25:06 UTC
Last seen:2021-07-14 16:11:22 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash cf8113cdf9d71dde8baf28192dd4ab3f (6 x Smoke Loader, 2 x ArkeiStealer, 1 x CryptBot)
ssdeep 3072:fBNmn9w5zAO9QhfTglZl/cwMm59pFo1ODQo/GjvyHv:ZgczAOcfkXlkwRpFgODIvC
Threatray 559 similar samples on MalwareBazaar
TLSH T184149C2132A0D432F6F745306475D6A12A7BB9323A74CD4F3B5427AE1E312D19ABE30B
Reporter abuse_ch
Tags:Dofoil exe Smoke Loader

Intelligence

File Origin
# of uploads :
2
# of downloads :
215
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
1d2b13ca8358bc5ddb5259b21d54c58b.exe
Verdict:
Suspicious activity
Analysis date:
2021-07-14 15:37:43 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/b6e70cc1-6d35-4607-9e5a-dce5558eb3b2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DLInjector01
Create hunting rule
Link:
https://www.capesandbox.com/analysis/171738/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.487.9280.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1448558d-36b0-4c48-8f42-92c412b379bb
Result
Threat name:
Djvu Raccoon RedLine SmokeLoader Tofsee
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/816441
Signature
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Contains functionality to steal Internet Explorer form passwords
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
DLL reload attack detected
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Performs DNS queries to domains with low reputation
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Renames NTDLL to bypass HIPS
Sample uses process hollowing technique
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to resolve many domain names, but no domain seems valid
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Yara detected Djvu Ransomware
Yara detected Raccoon Stealer
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Tofsee
Yara detected Vidar
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 448852 Sample: etSPaoVcAD.exe Startdate: 14/07/2021 Architecture: WINDOWS Score: 100 72 www.google.co.za 2->72 74 fastpool.xyz 2->74 76 8 other IPs or domains 2->76 90 Multi AV Scanner detection for domain / URL 2->90 92 Found malware configuration 2->92 94 Antivirus detection for URL or domain 2->94 98 13 other signatures 2->98 10 etSPaoVcAD.exe 2->10         started        13 gbgbddh 2->13         started        15 svchost.exe 1 2->15         started        17 4 other processes 2->17 signatures3 96 Tries to resolve many domain names, but no domain seems valid 72->96 process4 signatures5 118 DLL reload attack detected 10->118 120 Detected unpacking (changes PE section rights) 10->120 122 Contains functionality to inject code into remote processes 10->122 19 etSPaoVcAD.exe 1 10->19         started        124 Injects a PE file into a foreign processes 13->124 22 gbgbddh 1 13->22         started        process6 file7 100 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 19->100 102 Renames NTDLL to bypass HIPS 19->102 104 Maps a DLL or memory area into another process 19->104 25 explorer.exe 19 19->25 injected 46 C:\Users\user\AppData\Local\Temp\AE30.tmp, PE32 22->46 dropped 106 Checks if the current machine is a virtual machine (disk enumeration) 22->106 108 Creates a thread in another existing process (thread injection) 22->108 signatures8 process9 dnsIp10 84 999080321yomtest251-service10020125999080321.ru 25->84 86 999080321yirtest231-service10020125999080321.ru 25->86 88 88 other IPs or domains 25->88 48 C:\Users\user\AppData\Roaming\gbgbddh, PE32 25->48 dropped 50 C:\Users\user\AppData\Local\Temp\DF1A.exe, PE32 25->50 dropped 52 C:\Users\user\AppData\Local\Temp\DA37.exe, PE32 25->52 dropped 54 7 other files (4 malicious) 25->54 dropped 126 System process connects to network (likely due to code injection or exploit) 25->126 128 Benign windows process drops PE files 25->128 130 Performs DNS queries to domains with low reputation 25->130 134 4 other signatures 25->134 30 D208.exe 2 5 25->30         started        34 5F3D.exe 80 25->34         started        37 C8A1.exe 1 25->37         started        39 16 other processes 25->39 file11 132 Tries to resolve many domain names, but no domain seems valid 86->132 signatures12 process13 dnsIp14 56 C:\Users\user\AppData\...\MicrosoftApi.exe, PE32+ 30->56 dropped 58 C:\Users\user\...\ICSharpCode.SharpZipLib.dll, PE32 30->58 dropped 136 Detected unpacking (changes PE section rights) 30->136 138 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 30->138 140 Query firmware table information (likely to detect VMs) 30->140 156 2 other signatures 30->156 41 MicrosoftApi.exe 30->41         started        78 telete.in 195.201.225.248, 443, 49760 HETZNER-ASDE Germany 34->78 80 34.89.184.90, 49761, 80 GOOGLEUS United States 34->80 60 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 34->60 dropped 62 C:\Users\user\AppData\...\vcruntime140.dll, PE32 34->62 dropped 64 C:\Users\user\AppData\...\ucrtbase.dll, PE32 34->64 dropped 70 56 other files (none is malicious) 34->70 dropped 142 Detected unpacking (overwrites its own PE header) 34->142 144 Tries to steal Mail credentials (via file access) 34->144 146 Contains functionality to steal Internet Explorer form passwords 34->146 66 C:\Users\user\AppData\Local\Temp\1105.tmp, PE32 37->66 dropped 148 DLL reload attack detected 37->148 158 5 other signatures 37->158 82 999080321newfolder1002-01462599908032135.site 39->82 68 C:\Users\user\AppData\Local\...\vwhswbun.exe, PE32 39->68 dropped 150 System process connects to network (likely due to code injection or exploit) 39->150 152 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 39->152 154 Tries to harvest and steal browser information (history, passwords, etc) 39->154 160 2 other signatures 39->160 44 conhost.exe 39->44         started        file15 signatures16 process17 signatures18 110 Detected unpacking (changes PE section rights) 41->110 112 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 41->112 114 Query firmware table information (likely to detect VMs) 41->114 116 3 other signatures 41->116
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5e30a88fb1c9a45bd6697990493098ca05e87b2560172ae89e9811ea887ff8b4/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-07-14 15:26:05 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lyykrd5rzgsfxvtjpgiesmeyzic6q6zfmalsv2e6tai6vcd77c2a._file
Verdict:
suspicious
Similar samples:
08158e947e60d291cb15ea3f5d34dddaaf596225ee75f21b8789bef807e8c65e
Smoke Loader
42409087896ad827ca16b713215988bed28560c5fe0c929f7c30294854b5bfc2
Smoke Loader
4a0ecbcf9b54ed1c9654eb9ee214a797f48c980c6d03a261f62fa9671a2733d6
Smoke Loader
63761462358e1f880dafe51b3de8036f10bc60354b981cddc8075aed22e1251d
Smoke Loader
71c0a6fb3c31d1fa82fb99ddda7811810d9bf6306ce7e3377547035fe6b512f2
Smoke Loader
8b7e447356ade4824db0565f713751a6c0b37cc560269ced9cc6176e1d1fdd24
Smoke Loader
948bae9510601455f2ba50d694a6561bf2e85071b86161a0186672616ae17a77
Smoke Loader
9f42f0539f682f13af0c8da768e854d2bd2d547047caf431b7e5136f6955f81d
Smoke Loader
b148a9228e806a666a057a6d69180ed21dbdc26ee28e754b00e98efdcae15c66
Smoke Loader
fc5f8356ee7ba0be1f0f4c24ac4944481759352d665bbc1208295d39cd3da30f
Smoke Loader
+ 549 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:raccoon family:redline family:smokeloader family:tofsee family:vidar family:xmrig botnet:517 botnet:824 botnet:btccach botnet:q backdoor discovery evasion infostealer miner persistence spyware stealer themida trojan
Link:
https://tria.ge/reports/210714-plam5wtkva/
Behaviour
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Kills process with taskkill
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Enumerates physical storage devices
Launches sc.exe
Drops file in System32 directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks BIOS information in registry
Deletes itself
Loads dropped DLL
Modifies file permissions
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Themida packer
Creates new service(s)
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
Sets service image path in registry
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Vidar Stealer
XMRig Miner Payload
Raccoon
RedLine
RedLine Payload
SmokeLoader
Tofsee
Vidar
Windows security bypass
xmrig
Malware Config
C2 Extraction:
http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
http://999080321test61-service10020125999080321.website/
http://999080321test51-service10020125999080321.xyz/
http://999080321test41-service100201pro25999080321.ru/
http://999080321yest31-service100201rus25999080321.ru/
http://999080321rest21-service10020125999080321.eu/
http://999080321test11-service10020125999080321.press/
http://999080321newfolder4561-service10020125999080321.ru/
http://999080321rustest213-service10020125999080321.ru/
http://999080321test281-service10020125999080321.ru/
http://999080321test261-service10020125999080321.space/
http://999080321yomtest251-service10020125999080321.ru/
http://999080321yirtest231-service10020125999080321.ru/
http://nusurtal4f.net/
http://netomishnetojuk.net/
http://escalivrouter.net/
http://nick22doom4.net/
http://wrioshtivsio.su/
http://nusotiso4.su/
http://rickkhtovkka.biz/
http://palisotoliso.net/
45.32.235.238:45555
185.53.46.82:3214
https://olegf9844.tumblr.com/
Unpacked files
SH256 hash:
40f733e06f7bcb4bd915fbd0c3fbb05ee571094c0999c0104b661e9de72b8ec2
MD5 hash:
cda6ff3c17a09d22225df0ae90c705dc
SHA1 hash:
d822189153fb12866cb798cbfbe198a7b40e62ca
Link:
https://www.unpac.me/results/f9481565-7c0a-4262-bd20-87186cb24dd1/
SH256 hash:
5e30a88fb1c9a45bd6697990493098ca05e87b2560172ae89e9811ea887ff8b4
MD5 hash:
1d2b13ca8358bc5ddb5259b21d54c58b
SHA1 hash:
23ad080a2663d7dfc74ba5ec65d0a898497f255c
Link:
https://www.unpac.me/results/f9481565-7c0a-4262-bd20-87186cb24dd1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5e30a88fb1c9a45bd6697990493098ca05e87b2560172ae89e9811ea887ff8b4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_DLInjector01
Create hunting rule
Author:ditekSHen
Description:Detects specific downloader injector shellcode

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 5e30a88fb1c9a45bd6697990493098ca05e87b2560172ae89e9811ea887ff8b4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1453973/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/171738/

Comments