MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7a271f6c34a12ada4d25503316bfdd9f8806acc6619af04427f509f173d49132. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7a271f6c34a12ada4d25503316bfdd9f8806acc6619af04427f509f173d49132
SHA3-384 hash: 89e99eafe0293ac02c081df032a89aaa56f6de377193c83373fa397cb2f48a5fceb8c50d2a0c6e76760e483e1dd0d8a3
SHA1 hash: e0613991f33926274ba882b31e694fa46b00e5ac
MD5 hash: 459e78f341b5c9420dad4406eaf217bc
humanhash: football-timing-papa-cup
File name:459e78f341b5c9420dad4406eaf217bc
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:196'096 bytes
First seen:2021-08-03 15:40:04 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 41772127f978069b9f399090f08eba15 (4 x Smoke Loader, 3 x RaccoonStealer, 1 x DanaBot)
ssdeep 3072:oadLJ5eRpTQXSurSltsWFNaLoUdiQT5SStKmnm1YqvuArywoOLi6:XLHeRpQXSurSltsWFNaLoUnseqdvuRwh
Threatray 2'327 similar samples on MalwareBazaar
TLSH T1B114CED03490CA72E16116B19C71C6B06B2BBCF1EC3D5A873FB5626D4F362D2EA25346
dhash icon 1272d292105c5c03 (31 x RaccoonStealer, 6 x Smoke Loader, 4 x Loki)
Reporter zbetcheckin
Tags:32 exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
158
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
459e78f341b5c9420dad4406eaf217bc
Verdict:
Suspicious activity
Analysis date:
2021-08-03 15:43:29 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e93076e2-0fa6-4104-9d42-101c4714b585

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/176117/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Deleting a recently created file
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Searching for analyzing tools
Searching for the window
Connection attempt
Sending an HTTP POST request
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Launching a process
Reading critical registry keys
Using the Windows Management Instrumentation requests
Creating a process with a hidden window
Setting browser functions hooks
Unauthorized injection to a recently created process
Query of malicious DNS domain
Connection attempt to an infection source
Sending a TCP request to an infection source
Unauthorized injection to a system process
Deleting of the original file
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Sending an HTTP GET request to an infection source
Unauthorized injection to a browser process
Launching a file downloaded from the Internet
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6f2eeabd-d8c4-4555-80d1-0d27852748ea
Result
Threat name:
SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/826322
Signature
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to resolve many domain names, but no domain seems valid
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 458754 Sample: JY2WV2vcxy Startdate: 03/08/2021 Architecture: WINDOWS Score: 100 32 Multi AV Scanner detection for domain / URL 2->32 34 Found malware configuration 2->34 36 Multi AV Scanner detection for submitted file 2->36 38 5 other signatures 2->38 7 JY2WV2vcxy.exe 2->7         started        10 jusbsfe 2->10         started        process3 signatures4 50 Detected unpacking (changes PE section rights) 7->50 52 Contains functionality to inject code into remote processes 7->52 54 Injects a PE file into a foreign processes 7->54 12 JY2WV2vcxy.exe 7->12         started        56 Multi AV Scanner detection for dropped file 10->56 58 Machine Learning detection for dropped file 10->58 15 jusbsfe 10->15         started        process5 signatures6 60 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 12->60 62 Maps a DLL or memory area into another process 12->62 64 Checks if the current machine is a virtual machine (disk enumeration) 12->64 17 explorer.exe 2 12->17 injected 66 Creates a thread in another existing process (thread injection) 15->66 process7 dnsIp8 26 readinglistforjuly9.xyz 141.136.0.194, 49730, 80 NANO-ASLV Latvia 17->26 28 readinglistforjuly9.club 17->28 30 31 other IPs or domains 17->30 22 C:\Users\user\AppData\Roaming\jusbsfe, PE32 17->22 dropped 24 C:\Users\user\...\jusbsfe:Zone.Identifier, ASCII 17->24 dropped 40 System process connects to network (likely due to code injection or exploit) 17->40 42 Benign windows process drops PE files 17->42 44 Performs DNS queries to domains with low reputation 17->44 48 2 other signatures 17->48 file9 46 Tries to resolve many domain names, but no domain seems valid 28->46 signatures10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7a271f6c34a12ada4d25503316bfdd9f8806acc6619af04427f509f173d49132/
Threat name:
Win32.Trojan.Sabsik
Create hunting rule
Status:
Malicious
First seen:
2021-08-03 15:40:12 UTC
AV detection:
28 of 46 (60.87%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pitr63buuevnutjfkazrnp65t6eanlggmgnparbh6ue7c46useza._file
Verdict:
malicious
Similar samples:
1bf74cb8e8298fe42ed4956def3e9fce1d095a138516487b378935455223d112
Smoke Loader
4a1f935a5f94e5b3d7d0c79dcd01a96d69650bfeadc4a49d6548b118e82e1e16
Smoke Loader
5d2140c3ab1944f381206aa8d5c3ae0e5c2dad60751d3a2f631b1b08a810baa2
Smoke Loader
76526cd30725afafe90b7f19fbb607571ac7f827aece34bf1d1cc41c595f2a93
Smoke Loader
a3eaf45cf366908149a9143b9426bfa6c3dacca3ffb910031c2d7d65fa51fd0d
Smoke Loader
d1697994428238aced8ff24acff0b131d9737a0659a81e4a7395a746c5ce353e
Smoke Loader
d3849946eb2dd2aa6bebcddb30751a4a99bc05ee5011db3f5081df2f970a1854
Smoke Loader
fe74f3ee571f291acdaa6d0546bc16e7d5feb3ca1bd6ad1fb3c74b73483b871b
Smoke Loader
fff093b2593add9b7f59377b88e4e9586a8b728d82df197aad087d7e95615fd9
Smoke Loader
+ 2'317 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:raccoon family:redline family:smokeloader family:vidar family:xmrig botnet:408 botnet:cd8dc1031358b1aec55cc6bc447df1018b068607 botnet:test backdoor discovery evasion infostealer miner spyware stealer suricata themida trojan
Link:
https://tria.ge/reports/210803-z2x6lqrwva/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Kills process with taskkill
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
Checks BIOS information in registry
Deletes itself
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Themida packer
Downloads MZ/PE file
Executes dropped EXE
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Vidar Stealer
Raccoon
Raccoon Stealer Payload
RedLine
RedLine Payload
SmokeLoader
Vidar
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
xmrig
Malware Config
C2 Extraction:
http://readinglistforjuly1.xyz/
http://readinglistforjuly2.xyz/
http://readinglistforjuly3.xyz/
http://readinglistforjuly4.xyz/
http://readinglistforjuly5.xyz/
http://readinglistforjuly6.xyz/
http://readinglistforjuly7.xyz/
http://readinglistforjuly8.xyz/
http://readinglistforjuly9.xyz/
http://readinglistforjuly10.xyz/
http://readinglistforjuly1.site/
http://readinglistforjuly2.site/
http://readinglistforjuly3.site/
http://readinglistforjuly4.site/
http://readinglistforjuly5.site/
http://readinglistforjuly6.site/
http://readinglistforjuly7.site/
http://readinglistforjuly8.site/
http://readinglistforjuly9.site/
http://readinglistforjuly10.site/
http://readinglistforjuly1.club/
http://readinglistforjuly2.club/
http://readinglistforjuly3.club/
http://readinglistforjuly4.club/
http://readinglistforjuly5.club/
http://readinglistforjuly6.club/
http://readinglistforjuly7.club/
http://readinglistforjuly8.club/
http://readinglistforjuly9.club/
http://readinglistforjuly10.club/
https://prophefliloc.tumblr.com/
205.185.119.191:18846
Unpacked files
SH256 hash:
567660462bf0b6efcb3355ec6a5806a8e68990f423cda4afb601dfd270d5ff54
MD5 hash:
9740d3ad5f3001f0ace007137fb42cfe
SHA1 hash:
94b48d76bfccc7cfe79ba8f3ed16409ee538b811
Link:
https://www.unpac.me/results/30b0e68c-20e9-4f6b-a7de-3eb9d8ec31f7/
SH256 hash:
7a271f6c34a12ada4d25503316bfdd9f8806acc6619af04427f509f173d49132
MD5 hash:
459e78f341b5c9420dad4406eaf217bc
SHA1 hash:
e0613991f33926274ba882b31e694fa46b00e5ac
Link:
https://www.unpac.me/results/30b0e68c-20e9-4f6b-a7de-3eb9d8ec31f7/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/7a271f6c34a1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7a271f6c34a12ada4d25503316bfdd9f8806acc6619af04427f509f173d49132

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 7a271f6c34a12ada4d25503316bfdd9f8806acc6619af04427f509f173d49132

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/176117/
  
URLhaus
https://urlhaus.abuse.ch/url/1502766/

Comments


Avatar
zbet commented on 2021-08-03 15:40:05 UTC

url : hxxp://2freeprivacytoolsforyou.xyz/downloads/toolspab2.exe