MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 728910839e21267b805ab2f042cab15f3567c28cab82843fe8f3f53f05303763. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 4


Intelligence 4 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 728910839e21267b805ab2f042cab15f3567c28cab82843fe8f3f53f05303763
SHA3-384 hash: 82e6aeade4e980e4e50dd7b2fdb8dd736d30e9bcb6260aa50f695fa349d95fb2b1cb96120a20257af989c61330f40a72
SHA1 hash: eb91eec0f5927e962e2ccc6930fbfac29bf1c46f
MD5 hash: c63708371d3f58160a47c944d51002c6
humanhash: mike-zebra-missouri-pizza
File name:SecuriteInfo.com.Generic19_c.BFWH.4327.15147
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:173'056 bytes
First seen:2020-06-19 14:44:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5ef0fa7a3192b47f8ad0f98a9700ed46 (1 x Smoke Loader)
ssdeep 3072:hl9eU93EPn2hN5IqgtTeedssB24m4HWKC4a4x451EENq:bE/8gdKEENq
Threatray 215 similar samples on MalwareBazaar
TLSH E904503A7BC7DA70F3DA1E39045CCDFF0B1D5F718ADE4E26A20421A83D5B15C8A28A55
Reporter SecuriteInfoCom
Tags:Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/9637/
Detection(s):
SecuriteInfo.com.Generic19_c.BFWH.4327.15147.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Emotet
Create hunting rule
Status:
Malicious
First seen:
2017-08-31 09:20:11 UTC
File Type:
PE (Exe)
Extracted files:
8
AV detection:
38 of 47 (80.85%)
Threat level:
  2/5
Verdict:
malicious
Similar samples:
04dc453eef135fdf917b2cfd671246cc9d4273f7c9c770fad407ef714bed02dc
Smoke Loader
15e9493c4f50b672fe801108d31ac6660d1d5787e0c71964a935a893aab12032
Smoke Loader
218a9186e336f916762f64853f94cab4f6edc3c5cb8cca7a3a84cbdec2ee51cb
Smoke Loader
41b0a4eba05ad382e109d412680e4a5a636cbc7dc6928c5de923d689f070ece4
Smoke Loader
569b8cf6219a91161d48291f13285babe58b3be185623f3ec44c65c8369c2278
Smoke Loader
8cd14212205658092f91a376a85fb70802200671ea0cbc74b73f1fcaf0f88ddb
Smoke Loader
9fba6ffeb90dd242748718d8272a4942496e76a4f68bdb4dd42f93b044b5ed50
Smoke Loader
a270b677976266c10d5f062135372fd3f848f4b4dcfeaedd249d5069dc9e962e
Smoke Loader
b43786f175549f7d8aba0d0213181d10a01a54ab6ac8256446b8f39de6022986
Smoke Loader
e63df6a7f5c2a30456c884959644745ee0174df416492324c5ee31635958f855
Smoke Loader
+ 205 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor persistence trojan
Link:
https://tria.ge/reports/201109-bjzjeryjr2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Maps connected drives based on registry
Deletes itself
Adds policy Run key to start application
SmokeLoader
Malware Config
C2 Extraction:
http://theoryrelativityquad.info/monster/images/team/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_nymaim_g0
Create hunting rule
Author:mak, msm, CERT.pl
Rule name:win_smokeloader_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_smokeloader_g4
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT
Rule name:win_smokeloader_g5
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/9637/

Comments