MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7128cfab39ecfb91110f39cdaf35c6d752524f139256ce7c5734f504692a42bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 13

Intelligence 13 IOCs YARA File information Comments

SHA256 hash:	7128cfab39ecfb91110f39cdaf35c6d752524f139256ce7c5734f504692a42bf
SHA3-384 hash:	9d532f327c05013150027ef890fb3d803beeee0536019b7767cf229046e3a10e10ea3c8914cae3f268748af8661c9015
SHA1 hash:	2be0578677a2ec508a0ad1d44912287214149795
MD5 hash:	36d449c5b4df2ce38341a6cbc96c0667
humanhash:	mango-idaho-colorado-connecticut
File name:	36d449c5b4df2ce38341a6cbc96c0667.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	305'152 bytes
First seen:	2021-12-10 07:54:27 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	722252831a6fc255294abdd3e1a4fd3e (2 x Smoke Loader)
ssdeep	6144:Zq1CJxUDvuYiSCW/QlKzDzZJYjZ5eksl23:IDGYiSCW/QlKXzb4Eks
Threatray	5'855 similar samples on MalwareBazaar
TLSH	T12354AE10A7A0D435F5B712F849B9A3BDB93F79B16B6491CB12D216EA1734AE0DC3031B
File icon (PE):
dhash icon	b6dacabecee6baa6 (72 x Stop, 68 x RedLineStealer, 55 x Smoke Loader)
Reporter	abuse_ch
Tags:	Dofoil exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

285

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

36d449c5b4df2ce38341a6cbc96c0667.exe

Verdict:

Suspicious activity

Analysis date:

2021-12-10 07:58:15 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/2f3cc739-c1df-430f-9493-70f5abc43ff8

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/213065/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

DNS request

Searching for synchronization primitives

Reading critical registry keys

Сreating synchronization primitives

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Sending an HTTP GET request

Creating a file in the %temp% directory

Creating a process from a recently created file

Query of malicious DNS domain

Unauthorized injection to a system process

Enabling autorun by creating a file

Sending an HTTP POST request to an infection source

Result

Malware family:

n/a

Score:

8/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/1497/overview

Behaviour

MalwareBazaar

MeasuringTime

SystemUptime

EvasionGetTickCount

EvasionQueryPerformanceCounter

CheckCmdLine

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/61b307da4d8e6f3a5e1ea699/reports/3b76999c-cf18-4d17-8385-0b0c4e154f4e/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

SmokeLoader

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/d3bdecb3-95a6-454b-84b2-0338cf316d05

Result

Threat name:

RedLine SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/905129

Signature

.NET source code contains method to dynamically call methods (often used by packers)

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Connects to many ports of the same IP (likely port scanning)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to infect the boot sector

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Hides threads from debuggers

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file has nameless sections

Query firmware table information (likely to detect VMs)

Sigma detected: Execution Of Other File Type Than .exe

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to evade analysis by execution special instruction which cause usermode exception

Yara detected RedLine Stealer

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7128cfab39ecfb91110f39cdaf35c6d752524f139256ce7c5734f504692a42bf/

Threat name:

Win32.Backdoor.Systembc

Status:

Malicious

First seen:

2021-12-10 00:31:16 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

22 of 28 (78.57%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=oeum7kzz5t5zceiphhg26nog25jfetytsjlm47cxgt2qi2jkik7q._file

Verdict:

malicious

Smoke Loader

65350ee5de866f54845c13472cc7e0257b55715560ff9696ba2d4dc0494991e6

Smoke Loader

83c67454738495db1e361f0b71c5ee08a6284080e4cb56070693a52537da214f

Smoke Loader

8a9c79cd2bf3fb8f4b4f588829f45057272aa2c10ad92a08208a635d0d048c3e

Smoke Loader

bc62ea77cc11d094fe78b54c1cb4ffde86966f3a4a2d8c7454337fbe995e0cca

Smoke Loader

c0348c9924f77a767d373b543916c02f18addc0e6dccc3db4fd75b6fd118b947

Smoke Loader

f6401919fd20e698ec964ca0df4eee18c1f13852eef32a9246fe4605cff79969

Smoke Loader

+ 5'845 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:arkei family:icedid family:raccoon family:redline family:smokeloader botnet:eab89db8f8e51b4a23c6cffb85db8684a0f53e06 botnet:f797145799b7b1b77b35d81de942eee0908da519 botnet:powercrypt campaign:3472686642 backdoor banker collection discovery evasion infostealer spyware stealer trojan

Link:

https://tria.ge/reports/211210-jr41nafga9/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks whether UAC is enabled

Checks BIOS information in registry

Deletes itself

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

Executes dropped EXE

Arkei Stealer Payload

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Arkei

IcedID, BokBot

Raccoon

RedLine

RedLine Payload

SmokeLoader

Malware Config

C2 Extraction:

http://host-data-coin-11.com/
http://file-coin-host-12.com/
http://srtuiyhuali.at/
http://fufuiloirtu.com/
http://amogohuigotuli.at/
http://novohudosovu.com/
http://brutuilionust.com/
http://bubushkalioua.com/
http://dumuilistrati.at/
http://verboliatsiaeeees.com/
firenicatrible.com
2.56.57.127:80