MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 627759c384f499d52d3f5c731deacea95b93dbc22b7e2d21556f3dfd94a75bc2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 12

Intelligence 12 IOCs YARA 1 File information Comments

SHA256 hash:	627759c384f499d52d3f5c731deacea95b93dbc22b7e2d21556f3dfd94a75bc2
SHA3-384 hash:	f32202cc85ea11e2b57ddb558ec74c2a04ea893bf95abf20180cbce0a57820a0731624f6cc68106d955d22cd1ba36d10
SHA1 hash:	0a4a0e5c5926626435a3edf5f509d0a02420bff6
MD5 hash:	b839b6969c263d7341cbad58e97b0eef
humanhash:	princess-pasta-mexico-friend
File name:	b839b6969c263d7341cbad58e97b0eef.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	198'656 bytes
First seen:	2022-11-15 15:15:36 UTC
Last seen:	2022-11-15 16:52:11 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	9b96582b550809a59a2cfe6ee51635e4 (5 x RedLineStealer, 4 x Tofsee, 4 x Amadey)
ssdeep	3072:mt7nrD05j4VdKRJmw1xIf3/G5UNNohGBTsIG9xlpjRz:mrc6KRZ1xIf3/G5gNmmAlj
Threatray	13'181 similar samples on MalwareBazaar
TLSH	T14E14AE137640E033C05699309939C2F16A2AFC7EE96A9B8777547F1EBE713C16A26307
TrID	48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	0060646c6c6c6c2c (1 x Smoke Loader)
Reporter	abuse_ch
Tags:	Dofoil exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

206

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

b839b6969c263d7341cbad58e97b0eef.exe

Verdict:

No threats detected

Analysis date:

2022-11-15 15:21:51 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/f5dcda22-9f30-4048-8e56-e08760be83d0

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

SmokeLoader

Link:

https://www.capesandbox.com/analysis/334386/

Detection(s):

SecuriteInfo.com.Win32.BotX-gen.16679.5244.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Enabling autorun by creating a file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

anti-vm greyware packed

Link:

https://www.filescan.io/uploads/6373ad34f75d59fef0b978df/reports/e4cc6ed1-08cb-4b47-86b2-017337d6baea/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

SystemBC RAT

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/5a3e5166-8834-4251-82a3-d66f4640ba26

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1113923

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/627759c384f499d52d3f5c731deacea95b93dbc22b7e2d21556f3dfd94a75bc2/

Threat name:

Win32.Trojan.Raccoon

Status:

Malicious

First seen:

2022-11-15 14:57:19 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

27 of 39 (69.23%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mj3vtq4e6sm5klj7lrzr32wovfnzhw6cfn7c2ikvn4673ffhlpba._file

Verdict:

malicious

Smoke Loader

2ad9af4d99a267b9999bf64ae074415083055d48381a60556d38265c2a167c49

Smoke Loader

35b35f7a9c55c224797d87a8dc94e5f3fe9965fac4bcf6c6b8b3d9864e2728ce

Smoke Loader

417922cc2572bfcde644ecf343f88d6f956739fbc35107b558e071d55212c44b

Smoke Loader

6a37c10bfbb386f63bfa5e3a4894a9c24defa658a69dc3c65c5bb7a5e5c9fac7

Smoke Loader

d1ec311305c9420d548b5dbf0d921a13a20bd1d713b7f4901540a74dfce0ee7f

Smoke Loader

d499722506ffbbe3929dda28871541fefe791cba266cd92acfd95a9f95b9b33a

Smoke Loader

+ 13'171 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor trojan

Link:

https://tria.ge/reports/221115-snhgxsee23/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Detects Smokeloader packer

SmokeLoader

Verdict:

Informative

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/37b67ef0-e23f-4875-adf5-382258353593

Unpacked files

SH256 hash:

129d4aca1e9349da4b486c59e512087235e87f99778af933b55c0f516431b184

MD5 hash:

46acff90b7a238149c5030c1d82f5dfd

SHA1 hash:

1b43ecf0ea9bd512aac4e4e480665e70aff00e1a

Detections:

win_smokeloader_a2

SmokeLoaderStage2

Link:

https://www.unpac.me/results/0c53eee3-15c2-472e-94d4-6855903fdbd9/

Parent samples :

9d07d42192235ca3b5ee879a2d81f28313a427862ae10931306406ae5965092d
6dbd206ef6296fe378dc4367b5ec9c07e65a9863a2fefb55716a39c48e144d21
30a793b1398df37b640885e20c1c16d231dd3bff9ee77d95a27e295c88c17e9e
627759c384f499d52d3f5c731deacea95b93dbc22b7e2d21556f3dfd94a75bc2
70814ddb80cccda788820b580b7ce4d9deecf3cd30bb4742ab37df7c838477a9
af2edb431e026575bf1b73f79bb4145af87586a594635075a470636a7e78b1dd

SH256 hash:

627759c384f499d52d3f5c731deacea95b93dbc22b7e2d21556f3dfd94a75bc2

MD5 hash:

b839b6969c263d7341cbad58e97b0eef

SHA1 hash:

0a4a0e5c5926626435a3edf5f509d0a02420bff6

Link:

https://www.unpac.me/results/0c53eee3-15c2-472e-94d4-6855903fdbd9/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/627759c384f499d52d3f5c731deacea95b93dbc22b7e2d21556f3dfd94a75bc2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.