MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7879dd6673774fb2120e6a951ba09a556de969ec893abc27a3b8781c9a50258c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7879dd6673774fb2120e6a951ba09a556de969ec893abc27a3b8781c9a50258c
SHA3-384 hash: fbd6f35c8ea53fb5bb2a886790eaa29b3eb7068655b88eac91a0f2523b0c99c3aa419205be611d20cd90fc42555b5ded
SHA1 hash: e4fbed98da6c575b72842fc3dd2ccdac0b97edd2
MD5 hash: f7603325c99ad9640607fa54d2afe9d5
humanhash: fifteen-nebraska-cold-burger
File name:f7603325c99ad9640607fa54d2afe9d5.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:274'432 bytes
First seen:2022-01-31 03:52:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0ec2c89c6a88255f4d3cc69aff16c453 (1 x Smoke Loader)
ssdeep 3072:zuIs5NwQv/945wRBcVcF976rszmIMJx3SVggjcGkNIVqIGpZa9uD6Vdyhknfedm:zS52K79EszmL87ITsq9wVfG
TLSH T1D644CFC07E91C8B6D01536B18866CBE25B29FC31E960D50B3B7AD76E5E733C09A76309
File icon (PE):PE icon
dhash icon fcfcb4b4b4d4d9c1 (24 x RedLineStealer, 10 x Smoke Loader, 4 x RaccoonStealer)
Reporter abuse_ch
Tags:Dofoil exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
387
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
f7603325c99ad9640607fa54d2afe9d5.exe
Verdict:
Suspicious activity
Analysis date:
2022-01-31 03:54:04 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/9a0f5b7a-bbd7-43c3-a5a7-393565269341

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/228246/
Detection(s):
Win.Malware.Mikey-9917879-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Unauthorized injection to a recently created process
DNS request
Searching for synchronization primitives
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Sending an HTTP POST request
Sending a custom TCP request
Searching for the window
Creating a window
Query of malicious DNS domain
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/5550/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
CPUID_Instruction
EvasionGetTickCount
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
exploit greyware mikey qbot
Link:
https://www.filescan.io/uploads/61f75d20fc92af0d80a6f814/reports/4977749e-43af-41bb-a5c9-8c5ae050eeda/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
SystemBC
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b867c90f-a397-4ff9-addd-aa21fdf9b210
Result
Threat name:
SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/930495
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7879dd6673774fb2120e6a951ba09a556de969ec893abc27a3b8781c9a50258c/
Threat name:
Win32.Trojan.CrypterX
Create hunting rule
Status:
Malicious
First seen:
2022-01-30 22:51:44 UTC
File Type:
PE (Exe)
Extracted files:
45
AV detection:
32 of 43 (74.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pb452ztto5h3eeqonkkrxie2kvw6s2pmre5lyj5dxb4bzgsqewga._file
Verdict:
malicious
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor trojan
Link:
https://tria.ge/reports/220131-ee36dafca5/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Deletes itself
SmokeLoader
Malware Config
C2 Extraction:
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Unpacked files
SH256 hash:
788f723ebfe0110232b52ee15345acc5f74a53ea45e5f422dc5ce2eb5833fadc
MD5 hash:
198ff357daf4345c9fc869616b139381
SHA1 hash:
24c9899b296cf004e400b77e72b89f42bb726f37
Link:
https://www.unpac.me/results/7d31a0c6-2409-4f4e-9a86-ad2349b9999f/
Parent samples :
3c6f5e38acd57a6372e44dc341bf46060fef8c8b0e1dd3ffa38b21ddaddc3773
6861cdee1ee282ee8c69e31503d95291409907d8b27538f8082adb00205ad105
ccf4e081582226315f3a2bc171b604e3911d0225cc85e18188872ea9832a5388
be1c79275d836696a00b258d15a8b337a8c9beb8198a5bd3d5aaf64d660c8005
53bcd8239258dcbb10f9d3b6d057103c18fe3dd614c5809053426b01b741500d
SH256 hash:
7879dd6673774fb2120e6a951ba09a556de969ec893abc27a3b8781c9a50258c
MD5 hash:
f7603325c99ad9640607fa54d2afe9d5
SHA1 hash:
e4fbed98da6c575b72842fc3dd2ccdac0b97edd2
Link:
https://www.unpac.me/results/7d31a0c6-2409-4f4e-9a86-ad2349b9999f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7879dd6673774fb2120e6a951ba09a556de969ec893abc27a3b8781c9a50258c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 7879dd6673774fb2120e6a951ba09a556de969ec893abc27a3b8781c9a50258c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1995770/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1970142/
Cape
Cape
https://www.capesandbox.com/analysis/228246/

Comments