MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 63cd38e88915fce6ee48a8a9d658fad5c83624e2db415a4c151e84ad9a1af457. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 63cd38e88915fce6ee48a8a9d658fad5c83624e2db415a4c151e84ad9a1af457
SHA3-384 hash: e0e67307061db309869bc776052a8f04015daf01a36c3b335c5c3026846eec02d54b7db66a797593532eb94751ac8a80
SHA1 hash: 7ea0be6167405a6ee3ef4dff5b2337b26771047d
MD5 hash: 864ffb0d2b8f9e7ddabd50be7409046b
humanhash: wisconsin-apart-purple-alabama
File name:IE_CACHE_COOKIE.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:431'784 bytes
First seen:2023-05-23 06:22:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b78ecf47c0a3e24a6f4af114e2d1f5de (300 x GuLoader, 23 x Formbook, 21 x RemcosRAT)
ssdeep 12288:9vm6PqDvpoEm0hv8hMo3WENB3S+l9wwFTlULWrU3:pm6PsxobAv8uo3rluwNGaa
Threatray 943 similar samples on MalwareBazaar
TLSH T14294121237E4E4C9D582603ACEE0D279B731FC9284B64A6377D17F6B7DF9103A628241
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon f069696969696971 (1 x Smoke Loader, 1 x GuLoader)
Reporter JAMESWT_WT
Tags:exe signed Smoke Loader

Code Signing Certificate

Organisation:
Issuer:
Algorithm:sha256WithRSAEncryption
Valid from:2022-12-06T11:41:41Z
Valid to:2025-12-05T11:41:41Z
Serial number: 6a6090514e9c8c59a4f5ecb665fa4349557c82bf
Thumbprint Algorithm:SHA256
Thumbprint: 37428ba7af676c21f03db5e504f642071811576a763975f222c31f7a0dee4627
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
276
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
IE_CACHE_COOKIE.exe
Verdict:
Malicious activity
Analysis date:
2023-05-23 06:23:40 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9d24c56d-7b3e-4bf1-b673-3b53eec862d8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.HEUR.Backdoor.Win32.Androm.gen.2690.30779.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file
Creating a file in the %temp% subdirectories
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/87508/overview
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
buer lolbin overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/646c5bc7e4dc07f96e747f76/reports/9879666b-ad4b-4101-ad85-6c2ff951c6f7/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/63cd38e88915fce6ee48a8a9d658fad5c83624e2db415a4c151e84ad9a1af457
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/f38da978-dca5-41c6-81c2-4ca03f4613ca
Result
Threat name:
GuLoader, SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1240522
Signature
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Injects code into the Windows Explorer (explorer.exe)
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect Any.run
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected GuLoader
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 873524 Sample: IE_CACHE_COOKIE.exe Startdate: 23/05/2023 Architecture: WINDOWS Score: 100 45 dropbuyinc.ga 2->45 61 Snort IDS alert for network traffic 2->61 63 Multi AV Scanner detection for domain / URL 2->63 65 Found malware configuration 2->65 67 7 other signatures 2->67 9 IE_CACHE_COOKIE.exe 2 22 2->9         started        13 heuwdii 16 2->13         started        signatures3 process4 file5 39 C:\Users\user\...\SoulKeyServicePlugin.dll, PE32+ 9->39 dropped 41 C:\Users\user\AppData\Local\...\System.dll, PE32 9->41 dropped 77 Tries to detect Any.run 9->77 79 Hides threads from debuggers 9->79 15 IE_CACHE_COOKIE.exe 14 9->15         started        43 C:\Users\user\AppData\Local\...\System.dll, PE32 13->43 dropped 81 Multi AV Scanner detection for dropped file 13->81 19 heuwdii 13->19         started        signatures6 process7 dnsIp8 49 107.172.130.133, 49809, 80 AS-COLOCROSSINGUS United States 15->49 51 Tries to detect Any.run 15->51 53 Maps a DLL or memory area into another process 15->53 55 Hides threads from debuggers 15->55 21 explorer.exe 4 5 15->21 injected 57 Checks if the current machine is a virtual machine (disk enumeration) 19->57 59 Creates a thread in another existing process (thread injection) 19->59 signatures9 process10 dnsIp11 47 dropbuyinc.ga 45.143.136.187, 49812, 49813, 80 GARANT-PARK-INTERNETRU Russian Federation 21->47 35 C:\Users\user\AppData\Roaming\heuwdii, PE32 21->35 dropped 37 C:\Users\user\...\heuwdii:Zone.Identifier, ASCII 21->37 dropped 69 Benign windows process drops PE files 21->69 71 Injects code into the Windows Explorer (explorer.exe) 21->71 73 Deletes itself after installation 21->73 75 2 other signatures 21->75 26 explorer.exe 16 21->26         started        29 explorer.exe 21->29         started        31 explorer.exe 21->31         started        33 6 other processes 21->33 file12 signatures13 process14 signatures15 83 System process connects to network (likely due to code injection or exploit) 26->83 85 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 26->85 87 Tries to steal Mail credentials (via file / registry access) 26->87 89 Tries to harvest and steal browser information (history, passwords, etc) 29->89
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/63cd38e88915fce6ee48a8a9d658fad5c83624e2db415a4c151e84ad9a1af457/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-05-22 08:22:34 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
8 of 23 (34.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mpgtr2ejcx6on3sivcu5mwh22xedmjhc3navutavd2ck3gq26rlq._file
Verdict:
malicious
Similar samples:
3722230201739f00b5967d0d77061f995f8c53f1f68911ba7faa7002797ef208
Smoke Loader
4ef7f19d2375be6cc0a9ec89af142e257820fe21e44492cee6537a3abf432d90
Smoke Loader
693e8f8b588610bfc9ed0592d7ec7486d0b039cc0651a710c642c1f19c0037d1
Smoke Loader
69780102e183d8000b20a65a2ff9f4cdac57a35b8a287103029b859294f85922
Smoke Loader
723ff97e6559f6558c288ca693898592a21aab28c003883ca13b81667d7e3aef
Smoke Loader
74ac060cf278b238c8b162cb85b87d6db26c2fdcb904c2e6727454434a20cbd0
Smoke Loader
757ecedd9789cb6d77831f2e2c0fc312b05d9ad3e0f6d5c46e3d9c26ce325bc8
Smoke Loader
b534709b0de0c4392af03fea261580b08915ae1e5a55496f85dc21500c6a8338
Smoke Loader
c8edfb818e8a68ef4c127122bf9ae430d6d43ece8c9e70627cccb44e486f2827
Smoke Loader
f8082dc1210616c55008edc73e1ca4966cd8575e2425ed72f71f28b97f71172a
Smoke Loader
+ 933 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor collection discovery trojan
Link:
https://tria.ge/reports/230523-g5gfeaea62/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Checks installed software on the system
Checks QEMU agent file
Loads dropped DLL
SmokeLoader
Malware Config
C2 Extraction:
http://dropbuyinc.ga/
http://omacrestinc.ga/
Unpacked files
SH256 hash:
fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
MD5 hash:
3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 hash:
fe582246792774c2c9dd15639ffa0aca90d6fd0b
Link:
https://www.unpac.me/results/e43a06ed-0aec-43f9-a29d-93577b79e287/
SH256 hash:
63cd38e88915fce6ee48a8a9d658fad5c83624e2db415a4c151e84ad9a1af457
MD5 hash:
864ffb0d2b8f9e7ddabd50be7409046b
SHA1 hash:
7ea0be6167405a6ee3ef4dff5b2337b26771047d
Link:
https://www.unpac.me/results/e43a06ed-0aec-43f9-a29d-93577b79e287/
Malware family:
GuLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/63cd38e88915/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.03
Link:
https://yomi.yoroi.company/submissions/63cd38e88915fce6ee48a8a9d658fad5c83624e2db415a4c151e84ad9a1af457

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 63cd38e88915fce6ee48a8a9d658fad5c83624e2db415a4c151e84ad9a1af457

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2639331/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2639330/

Comments