MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 608d90507e8477ca85b911f790799f13f8d04cc380d346b78358237a9480de6d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 7

Intelligence 7 IOCs YARA File information Comments

SHA256 hash:	608d90507e8477ca85b911f790799f13f8d04cc380d346b78358237a9480de6d
SHA3-384 hash:	f15ffe19c79734b8f924c2130044448d72d3aa8f7642a3ea1fa882fa7f1a80adca18c0bf4edfcb63fdc30bd6a9ee6759
SHA1 hash:	724ee2a57b92f0d773fcb53122a841838a2f1adb
MD5 hash:	4027a41cc4f3d834e8f9091a0f55641f
humanhash:	jig-salami-angel-charlie
File name:	ItsMe.zip
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	1'361 bytes
First seen:	2022-05-26 08:09:11 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	24:9ulmlij5w8T9tD/wGFpVEniZ17Up6Mf8z/rpjePeTqPvpnbH+II6+iilA2h4:9ulmYjLFpVEnifWOz/hTqPhnb+D6rili
TLSH	T18A21086BFB64C2A0F2F233753C84D983CD75E4AAE00035961B2411063CBC1BF0AA5900
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	Finch39487976
Tags:	EternityWorm Smoke Loader zip

Intelligence

File Origin

# of uploads :

# of downloads :

238

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Foxhole.Lnk_Zip_1.UNOFFICIAL

SecuriteInfo.com.Trojan.GenericKD.39690216.10467.24508.UNOFFICIAL

TwinWave.EvilLNK.PShellEncoderGamesTheMessage.20220523.UNOFFICIAL

SecuriteInfo.com.Trojan.GenericKD.39690216.7787.25389.UNOFFICIAL

Result

Verdict:

Malicious

File Type:

LNK File - Malicious

Link:

https://app.docguard.net/608d90507e8477ca85b911f790799f13f8d04cc380d346b78358237a9480de6d/results/dashboard

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive masquerade powershell

Link:

https://www.filescan.io/uploads/628f35b6054dcf0ecaf0afd9/reports/95cdec64-9bde-4917-b5eb-912420d33256/overview

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/608d90507e8477ca85b911f790799f13f8d04cc380d346b78358237a9480de6d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/608d90507e8477ca85b911f790799f13f8d04cc380d346b78358237a9480de6d/

Threat name:

Shortcut.Trojan.IcedID

Status:

Malicious

First seen:

2022-05-21 23:58:00 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

17 of 26 (65.38%)

Threat level:

5/5

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:redline family:smokeloader botnet:camp1 backdoor infostealer spyware suricata trojan

Link:

https://tria.ge/reports/220526-j2pzgsdefq/

Behaviour

Checks SCSI registry key(s)

Delays execution with timeout.exe

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks computer location settings

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

RedLine

RedLine Payload

SmokeLoader

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Malware Config

C2 Extraction:

http://motionberry999xerz.ru/
http://happyday9risce.com/
http://kokihap7siexz3.com/
https://motionberry999xerz.ru/
https://happyday9risce.com/
https://kokihap7siexz3.com/
65.109.11.10:8599

Dropper Extraction:

http://soapbeginshops.com/45d.hta

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/608d90507e8477ca85b911f790799f13f8d04cc380d346b78358237a9480de6d