MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 727727f29da32d4767af81b086ac291d6764dd4c74cbc5a7ddd3d83e6ff9cb88. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 727727f29da32d4767af81b086ac291d6764dd4c74cbc5a7ddd3d83e6ff9cb88
SHA3-384 hash: 5a323952103b495731259d2259e439fcf080bf878142442e455e4da80703508c895779266f778e2c7b0fb5ead8532779
SHA1 hash: 8282009d44e88cfc1974660a03feef5c1109f54f
MD5 hash: fb2a6a786318dbfa1abfcdf24b55f36d
humanhash: mars-uniform-freddie-eleven
File name:fb2a6a786318dbfa1abfcdf24b55f36d.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:175'104 bytes
First seen:2021-10-29 05:33:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 18875662b19ade4ddd6bba43f9abb4a3 (12 x RaccoonStealer, 3 x RedLineStealer, 1 x DanaBot)
ssdeep 3072:GCjq8W/DQvEi0p07RuiDrS4YXzI/pyG63tWrxpzbgqrukVggjcGkNIVqI:rj+/DQvEzG9pVYkhyG63tuzbgwuA7ITB
Threatray 2'238 similar samples on MalwareBazaar
TLSH T167049DF0769CC4F1D4A33531C866CAA1462ABC71DE7099473678221E1EB4ECC5AED35E
File icon (PE):PE icon
dhash icon fcfc94d4d4d4d8c0 (24 x RaccoonStealer, 21 x RedLineStealer, 9 x Smoke Loader)
Reporter abuse_ch
Tags:Dofoil exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
222
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Fragtor.35416.2589.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d38a0add-57ee-4f72-ac2a-759a66f804fb
Result
Threat name:
Raccoon RedLine SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/879026
Signature
.NET source code contains very large array initializations
Adds a directory exclusion to Windows Defender
Antivirus detection for URL or domain
Benign windows process drops PE files
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
DLL reload attack detected
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Renames NTDLL to bypass HIPS
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Script Execution From Temp Folder
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected Raccoon Stealer
Yara detected RedLine Stealer
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 511459 Sample: w1voKmCYOz.exe Startdate: 29/10/2021 Architecture: WINDOWS Score: 100 99 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->99 101 Multi AV Scanner detection for domain / URL 2->101 103 Antivirus detection for URL or domain 2->103 105 10 other signatures 2->105 10 w1voKmCYOz.exe 2->10         started        12 ifswfjb 2->12         started        15 wsswfjb 2->15         started        process3 signatures4 17 w1voKmCYOz.exe 10->17         started        115 Multi AV Scanner detection for dropped file 12->115 117 Machine Learning detection for dropped file 12->117 20 ifswfjb 12->20         started        process5 signatures6 91 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 17->91 93 Maps a DLL or memory area into another process 17->93 95 Checks if the current machine is a virtual machine (disk enumeration) 17->95 22 explorer.exe 14 17->22 injected 97 Creates a thread in another existing process (thread injection) 20->97 process7 dnsIp8 83 216.128.137.31, 80 AS-CHOOPAUS United States 22->83 85 sysaheu90.top 185.185.69.21, 49771, 49772, 49773 SPRINTHOSTRU Russian Federation 22->85 87 5 other IPs or domains 22->87 61 C:\Users\user\AppData\Roaming\wsswfjb, PE32 22->61 dropped 63 C:\Users\user\AppData\Roaming\ifswfjb, PE32 22->63 dropped 65 C:\Users\user\AppData\Local\Temp\FAF8.exe, PE32 22->65 dropped 67 9 other malicious files 22->67 dropped 107 System process connects to network (likely due to code injection or exploit) 22->107 109 Benign windows process drops PE files 22->109 111 Deletes itself after installation 22->111 113 Hides that the sample has been downloaded from the Internet (zone.identifier) 22->113 27 E481.exe 1 22->27         started        31 876.exe 22->31         started        33 CD2F.exe 21 6 22->33         started        36 5 other processes 22->36 file9 signatures10 process11 dnsIp12 69 C:\Users\user\AppData\Local\Temp\1105.tmp, PE32 27->69 dropped 119 Multi AV Scanner detection for dropped file 27->119 121 DLL reload attack detected 27->121 123 Detected unpacking (changes PE section rights) 27->123 135 3 other signatures 27->135 125 Machine Learning detection for dropped file 31->125 127 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 31->127 129 Maps a DLL or memory area into another process 31->129 75 cdn.discordapp.com 162.159.129.233, 443, 49827, 49832 CLOUDFLARENETUS United States 33->75 71 C:\Users\user\AppData\...\AdvancedRun.exe, PE32 33->71 dropped 131 Adds a directory exclusion to Windows Defender 33->131 38 AdvancedRun.exe 33->38         started        41 powershell.exe 33->41         started        43 InstallUtil.exe 33->43         started        77 93.115.20.139, 28978, 49867 MVPShttpswwwmvpsnetEU Romania 36->77 79 telegalive.top 104.21.67.139, 49863, 80 CLOUDFLARENETUS United States 36->79 81 162.159.130.233, 443, 49856, 49859 CLOUDFLARENETUS United States 36->81 73 C:\Users\user\AppData\...\AdvancedRun.exe, PE32 36->73 dropped 133 Detected unpacking (overwrites its own PE header) 36->133 45 AdvancedRun.exe 36->45         started        47 powershell.exe 36->47         started        49 7D10.exe 36->49         started        51 FAF8.exe 36->51         started        file13 signatures14 process15 dnsIp16 89 192.168.2.1 unknown unknown 38->89 53 AdvancedRun.exe 38->53         started        55 conhost.exe 41->55         started        57 AdvancedRun.exe 45->57         started        59 conhost.exe 47->59         started        process17
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/727727f29da32d4767af81b086ac291d6764dd4c74cbc5a7ddd3d83e6ff9cb88/
Threat name:
Win32.Trojan.Fragtor
Create hunting rule
Status:
Malicious
First seen:
2021-10-28 21:45:54 UTC
AV detection:
15 of 28 (53.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oj3sp4u5umwuoz5pqgyinlbjdvtwjxkmotf4lj652pmd437zzoea._file
Verdict:
malicious
Similar samples:
021d14981d2829df6914d5c43e9aed8b8c7a80f2d7e03e5548eccc3db0188017
Smoke Loader
29669b199ce94a9ee97f8955480b8e8f5b0ed8b38824f4316f094668a71e0b2c
Smoke Loader
7f7b289e8bfd8e547f28478238c98b7ad31c7601e6033b5c1c79afc924b40a6c
Smoke Loader
98886fc4886cba3974e82ab69176ba4545ea10f6d8b61350d6088eaae9aba519
Smoke Loader
a499e99f2ec3aef0ed06f1d8c2c5b5752bdf1575cba0b2230ea49f810f2db7d4
Smoke Loader
c03c8a4852301c1c54ed27ef130d0de4cdfb98584adef3dda2a096177016a18b
Smoke Loader
+ 2'228 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:djvu family:raccoon family:redline family:smokeloader family:vidar botnet:21321313 botnet:517 botnet:68e2d75238f7c69859792d206401b6bde2b2515c botnet:706 botnet:754 botnet:9b47742e621d3b0f1b0b79db6ed26e2c33328c05 botnet:safeinstaller botnet:z0rm1on backdoor collection discovery infostealer ransomware spyware stealer suricata trojan
Link:
https://tria.ge/reports/211029-f93nrshddr/
Behaviour
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Checks SCSI registry key(s)
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Looks up external IP address via web service
Deletes itself
Loads dropped DLL
Modifies file permissions
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
Vidar Stealer
Detected Djvu ransomware
Djvu Ransomware
Raccoon
RedLine
RedLine Payload
SmokeLoader
Suspicious use of NtCreateProcessExOtherParentProcess
Vidar
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
Malware Config
C2 Extraction:
http://xacokuo8.top/
http://hajezey1.top/
http://nusurtal4f.net/
http://netomishnetojuk.net/
http://escalivrouter.net/
http://nick22doom4.net/
http://wrioshtivsio.su/
http://nusotiso4.su/
http://rickkhtovkka.biz/
http://palisotoliso.net/
http://193.56.146.214/
https://193.56.146.214/
https://mas.to/@lilocc
185.183.32.161:80
93.115.20.139:28978
185.215.113.94:15564
https://mas.to/@xeroxxx
http://rlrz.org/lancer
Unpacked files
SH256 hash:
7504bf3fa2768578ecf547d7ad5ee704bb32a345726f4d6007e4905db82c873c
MD5 hash:
67832761c9fb6dcaa2caaa433aeef1e9
SHA1 hash:
1f40855c5efb001c8dff2d10e10b8c68d573d68f
Link:
https://www.unpac.me/results/e314324c-e1b2-450b-a8c5-fdf409ba6451/
SH256 hash:
727727f29da32d4767af81b086ac291d6764dd4c74cbc5a7ddd3d83e6ff9cb88
MD5 hash:
fb2a6a786318dbfa1abfcdf24b55f36d
SHA1 hash:
8282009d44e88cfc1974660a03feef5c1109f54f
Link:
https://www.unpac.me/results/e314324c-e1b2-450b-a8c5-fdf409ba6451/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/727727f29da3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/727727f29da32d4767af81b086ac291d6764dd4c74cbc5a7ddd3d83e6ff9cb88

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 727727f29da32d4767af81b086ac291d6764dd4c74cbc5a7ddd3d83e6ff9cb88

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1719493/
  
Delivery method
Distributed via web download

Comments