MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 61c9c413d2ded69e3775460138b908256636c80cc11ad177e26277899c11f199. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 11

Intelligence 11 IOCs YARA File information Comments

SHA256 hash:	61c9c413d2ded69e3775460138b908256636c80cc11ad177e26277899c11f199
SHA3-384 hash:	c477fadedf7d37a1868b3d6ca5090da676f82aca8e40805fa3e9d081ca027e96a3dfc11e6ad223ea2fc05a5a772c971e
SHA1 hash:	46dcef431aa222607d7cf08bbcddff41c8629b3d
MD5 hash:	41b8400ba612978d02509d4896e5414d
humanhash:	eight-oven-utah-nine
File name:	41b8400ba612978d02509d4896e5414d.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	217'600 bytes
First seen:	2022-04-20 09:31:58 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	4cf51b7369ef0b905b80a8d052c9cffd (1 x DanaBot, 1 x Smoke Loader)
ssdeep	3072:OP3mqe1uFgaT6Izor9j3zk4vJaflyMdajr:MI1uFgaWRxjDBSo
Threatray	16'311 similar samples on MalwareBazaar
TLSH	T17F24AD2277E0C031D1A3693178B5D7B26B7FB8325B74488B7B54276A1EF02C096B6727
TrID	48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	480c1c4c4f594b14 (172 x Smoke Loader, 134 x RedLineStealer, 98 x Amadey)
Reporter	abuse_ch
Tags:	Dofoil exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

449

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/264941/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Searching for synchronization primitives

Сreating synchronization primitives

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Sending an HTTP POST request

Unauthorized injection to a system process

Enabling autorun by creating a file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware

Link:

https://www.filescan.io/uploads/625fd318eab80a7a6c496497/reports/82685435-72d2-4146-9c52-0672663e28df/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

AZORult

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/7020095c-1615-4507-bc22-5ab88b284ab7

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/979442

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/61c9c413d2ded69e3775460138b908256636c80cc11ad177e26277899c11f199/

Threat name:

Win32.Trojan.Raccrypt

Status:

Malicious

First seen:

2022-04-19 21:28:49 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

31 of 41 (75.61%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=mhe4ie6s33lj4n3viyatroiievtdnsamyennc57cmj3ythar6gmq._file

Verdict:

malicious

Smoke Loader

161da33d9550b2e9c838abc55513091a070af910a882eab015fd2a5f96e025f3

Smoke Loader

6e9c8c5fc2fe5fc0ec186bc8ae4cdedb6700e91b7c5c5d2d68b70584ac26dc91

Smoke Loader

7913fabae6d02e80acf5bd476fd5fe3f6d3077001780c75c40596ea657b4067a

Smoke Loader

97c090248e9c4bff5f867844b21d5637b176eabc32d6ef6013b5dd23e76d8081

Smoke Loader

a63b9c4ed6d83aff1bf47215f3297d5fb1cd85e69a24deac6750d511f61de055

Smoke Loader

ebf3a044246492128aa29dad0c4802f374fe32efb8179da5b9f284dc7e3579a4

Smoke Loader

edc39f88a7ef54af6e85f67335c07e6c782a4c0b63b37babff3dc4aa014eb7ac

Smoke Loader

+ 16'301 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor trojan

Link:

https://tria.ge/reports/220420-lhlh3abffm/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

SmokeLoader

Malware Config

C2 Extraction:

http://coralee.at/upload/
http://ducvietcao.com/upload/
http://biz-acc.ru/upload/
http://toimap.com/upload/
http://bbb7d.com/upload/
http://piratia-life.ru/upload/
http://curvreport.com/upload/
http://viagratos.com/upload/
http://mordo.ru/upload/
http://pkodev.net/upload/