MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e9c8c5fc2fe5fc0ec186bc8ae4cdedb6700e91b7c5c5d2d68b70584ac26dc91. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 12

Intelligence 12 IOCs YARA File information Comments

SHA256 hash:	6e9c8c5fc2fe5fc0ec186bc8ae4cdedb6700e91b7c5c5d2d68b70584ac26dc91
SHA3-384 hash:	afeaa49763e3245b2332b98e03aeb6a0879af2728e4aed2390a48b82f302cc13974ab9a0b0684dee109bf4752bc4eef1
SHA1 hash:	e57fa22af31188c692123fac2629391a4f53aedf
MD5 hash:	9caad4dc63f34f6b5b039a6400ddad6a
humanhash:	mango-pizza-sierra-network
File name:	9caad4dc63f34f6b5b039a6400ddad6a.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	279'040 bytes
First seen:	2022-03-28 08:13:12 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	159dcaa804632f606b007a362cfb6cc5 (3 x Stop, 2 x Smoke Loader, 1 x RedLineStealer)
ssdeep	3072:GVYLHIjJiZOvfjvl3ARGnEjMy9BCm6pL1Yafxv7XvDbLu2l:G6T4h7gMEw896zYYv7fLh
Threatray	4'172 similar samples on MalwareBazaar
TLSH	T1AA54BE123AC1C832E422D2756856CBB55BBBB87019355A8F3B84162D8F353E3DF7934A
File icon (PE):
dhash icon	5c599a3ce0c3c850 (43 x Stop, 37 x RedLineStealer, 36 x Smoke Loader)
Reporter	abuse_ch
Tags:	exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

198

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/258503/

Detection(s):

Win.Packed.Strab-9942213-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Sending an HTTP POST request

Sending a custom TCP request

Sending an HTTP GET request

Enabling autorun by creating a file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/11752/overview

Behaviour

SystemUptime

MeasuringTime

EvasionGetTickCount

CheckCmdLine

EvasionQueryPerformanceCounter

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware

Link:

https://www.filescan.io/uploads/62416e4ea19c6494129e2c31/reports/417dcf6e-b869-4810-a6d2-f9d2b9cd9cbc/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

STOP Ransomware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/fa6d9ff9-20c9-492b-bf64-512a02f5c71c

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/965608

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to evade debugger and weak emulator (self modifying code)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6e9c8c5fc2fe5fc0ec186bc8ae4cdedb6700e91b7c5c5d2d68b70584ac26dc91/

Threat name:

Win32.Trojan.Raccrypt

Status:

Malicious

First seen:

2022-03-28 03:20:24 UTC

AV detection:

23 of 26 (88.46%)

Threat level:

5/5

Verdict:

malicious

Smoke Loader

11a69bfb8a93253c13d7e6754d99a3bbedf0dc16d8b81b7ab1a2e8dc9a628bbf

Smoke Loader

11d70988c6bb7174dd4050db008c278920f14cbfa54920655ad1bdbaee082700

Smoke Loader

995cce8a3847b995d70f0d3148b782a3cdbc2b1297925dcb654bec2504bcf946

Smoke Loader

a820caf880ba4cb81e50891feb62ff304e0322a31141b11f3813fc477e2044e6

Smoke Loader

d796df8e7ea24a1076fcb5ec457e0b0c14219905fd34bf8d8761a6d2b1c546f9

Smoke Loader

f7b3c3137aa931a3ec93978f41edb88499f236f9759208e74fedf6a671c748c5

Smoke Loader

+ 4'162 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor trojan

Link:

https://tria.ge/reports/220328-j4zlpsdchp/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Program crash

Deletes itself

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

SmokeLoader

Malware Config

C2 Extraction:

http://coralee.at/upload/
http://ducvietcao.com/upload/
http://biz-acc.ru/upload/
http://toimap.com/upload/
http://bbb7d.com/upload/
http://piratia-life.ru/upload/
http://curvreport.com/upload/
http://viagratos.com/upload/
http://mordo.ru/upload/
http://pkodev.net/upload/