MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 687ca5a69fc193e08538b21f8b0aba4a279c75561873b45e71e3ce57721c815b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 13

Intelligence 13 IOCs YARA File information Comments 1

SHA256 hash:	687ca5a69fc193e08538b21f8b0aba4a279c75561873b45e71e3ce57721c815b
SHA3-384 hash:	023ce747babb3665cad42b35e67b8d7fce33f48afd57841caa8a23bc53a38c4eebc123c9aa642928bc773231992df011
SHA1 hash:	e13fc24891f57b025ca940c10a275cef805391fd
MD5 hash:	906365a300f67eeb42c867b9e8862403
humanhash:	edward-idaho-bluebird-salami
File name:	906365a300f67eeb42c867b9e8862403
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	289'280 bytes
First seen:	2022-04-06 11:13:31 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	5cbd107a7eb6202007731da5377c40ed (3 x Smoke Loader, 2 x Stop)
ssdeep	3072:TJXgb4pC4km0dfYcZCZtpN2orEj2UB0KtVggjcGkNIVqIpsxkgaBChUNJ:ZS4d2fYc0Xdy10y7ITsqdiga
Threatray	12'983 similar samples on MalwareBazaar
TLSH	T10454ADD272928471C056AE306866FBA1293F7831D630D41FF7B46B2F2E713D06AA17D6
File icon (PE):
dhash icon	fcf8b4b4b494d9c1 (17 x Smoke Loader, 8 x RedLineStealer, 6 x Amadey)
Reporter	zbetcheckin
Tags:	32 exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

263

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/261209/

Detection(s):

Win.Dropper.Raccoon-9916366-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Sending an HTTP POST request

Unauthorized injection to a system process

Enabling autorun by creating a file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/12797/overview

Behaviour

SystemUptime

MeasuringTime

EvasionGetTickCount

CheckCmdLine

EvasionQueryPerformanceCounter

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware

Link:

https://www.filescan.io/uploads/624d75fd40ce5db9f41a2f62/reports/a98a2333-18dc-44db-986c-acd7d4d278a1/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/fe47eb5c-97e4-4de3-b316-646f6e84df49

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/971411

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/687ca5a69fc193e08538b21f8b0aba4a279c75561873b45e71e3ce57721c815b/

Threat name:

Win32.Ransomware.StopCrypt

Status:

Malicious

First seen:

2022-04-06 11:14:08 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 26 (84.62%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=nb6klju7ygj6bbjywipywcv2jitzy5kwdbz3ixtr4phfo4q4qfnq._file

Verdict:

malicious

Smoke Loader

161da33d9550b2e9c838abc55513091a070af910a882eab015fd2a5f96e025f3

Smoke Loader

54e3ee54fac434e25c03ded56a4680f1ea40a245d657440ac9c51be7f27ef656

Smoke Loader

93fc4f2ee5e58547ba2073c5475e846a13f9e98209732bd160f9f5b355b41bca

Smoke Loader

a37cbddb545f168aa1dbb09433e228e5a956f6d8fbc00fae892a5f047990a71f

Smoke Loader

a63b9c4ed6d83aff1bf47215f3297d5fb1cd85e69a24deac6750d511f61de055

Smoke Loader

af94ec40248120d040629b0b921538db88886fb9534a7a167d06d2b6ef5da784

Smoke Loader

ebf3a044246492128aa29dad0c4802f374fe32efb8179da5b9f284dc7e3579a4

Smoke Loader

f83ecb4f14af221b78be6670174e22434c65a49586fdbcd65f0b75df529aa947

Smoke Loader

+ 12'973 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor trojan

Link:

https://tria.ge/reports/220406-nbzs8acca3/

Behaviour

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

SmokeLoader

Malware Config

C2 Extraction:

http://coralee.at/upload/
http://ducvietcao.com/upload/
http://biz-acc.ru/upload/
http://toimap.com/upload/
http://bbb7d.com/upload/
http://piratia-life.ru/upload/
http://curvreport.com/upload/
http://viagratos.com/upload/
http://mordo.ru/upload/
http://pkodev.net/upload/