MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 14


Intelligence 14 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0
SHA3-384 hash: 5d505ec668c8818f56a4e155669748ac560874093324992caa10f04ff4f75f05567c82977ac0a9634c997fd172b5e343
SHA1 hash: 884f343876a8bb0ebac63c28191c22c6f69590f8
MD5 hash: c34729173ecc820eb7674431597d78be
humanhash: white-lamp-sierra-lemon
File name:c34729173ecc820eb7674431597d78be.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:437'248 bytes
First seen:2022-10-16 06:06:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4cea7ae85c87ddc7295d39ff9cda31d1 (85 x RedLineStealer, 67 x LummaStealer, 61 x Rhadamanthys)
ssdeep 3072:yvGyYiSDnt1Et5CmPo8VGAnxoctr6Byd4TUISI:24UCp6n756BmlI
TLSH T1199405C133908067E8675A744EA3838AD769FCC1AE35719B2364F35E0B3BDD26EA5701
TrID 83.7% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
7.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
4.4% (.EXE) Win64 Executable (generic) (10523/12/4)
2.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
0.8% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 9269ccb2b2d4e830 (1 x Smoke Loader)
Reporter abuse_ch
Tags:exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
394
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
https://enlacesasociados.com/download/File.zip?pk=file.zip
Verdict:
Malicious activity
Analysis date:
2022-10-16 02:05:53 UTC
Tags:
loader opendir redline evasion stealer
Link:
https://app.any.run/tasks/370c648a-6f8d-4649-a477-bc857df6c5c3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/320639/
Detection(s):
SecuriteInfo.com.decompression.bomb.29185.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Сreating synchronization primitives
Sending an HTTP GET request
Launching a process
Unauthorized injection to a recently created process
Query of malicious DNS domain
Sending a TCP request to an infection source
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/43266/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
EvasionGetTickCount
EvasionQueryPerformanceCounter
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
advpack.dll rundll32.exe setupapi.dll shell32.dll
Link:
https://www.filescan.io/uploads/634b9f4c339362a6061a9497/reports/3f1e9b2d-03fc-456e-9f0a-d977382261e4/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/d817824d-8778-4008-95fe-61e9f9f6c3d1
Result
Threat name:
RedLine, SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1091345
Signature
.NET source code contains potential unpacker
Antivirus detection for dropped file
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Encrypted powershell cmdline option found
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Costura Assembly Loader
Yara detected RedLine Stealer
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 723955 Sample: S0XYEen3gW.exe Startdate: 16/10/2022 Architecture: WINDOWS Score: 100 54 neosheyliak.xyz 2->54 82 Snort IDS alert for network traffic 2->82 84 Multi AV Scanner detection for domain / URL 2->84 86 Malicious sample detected (through community Yara rule) 2->86 88 9 other signatures 2->88 10 S0XYEen3gW.exe 1 3 2->10         started        13 gcfsabs 2->13         started        17 rundll32.exe 2->17         started        signatures3 process4 dnsIp5 50 C:\Users\user\AppData\Local\...\SETUP_~1.EXE, PE32 10->50 dropped 19 SETUP_~1.EXE 15 5 10->19         started        70 www.filifilm.com.br 13->70 72 filifilm.com.br 13->72 116 Multi AV Scanner detection for dropped file 13->116 118 Machine Learning detection for dropped file 13->118 file6 signatures7 process8 dnsIp9 56 filifilm.com.br 108.179.193.18, 443, 49696, 49697 UNIFIEDLAYER-AS-1US United States 19->56 58 www.filifilm.com.br 19->58 48 Hwqujbjwlyvggktrai...administrator_s.exe, PE32 19->48 dropped 90 Antivirus detection for dropped file 19->90 92 Multi AV Scanner detection for dropped file 19->92 94 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 19->94 96 4 other signatures 19->96 24 Hwqujbjwlyvggktrainingadministrator_s.exe 14 4 19->24         started        28 SETUP_~1.EXE 4 19->28         started        30 powershell.exe 16 19->30         started        32 SETUP_~1.EXE 19->32         started        file10 signatures11 process12 dnsIp13 60 www.filifilm.com.br 24->60 62 filifilm.com.br 24->62 98 Multi AV Scanner detection for dropped file 24->98 100 Machine Learning detection for dropped file 24->100 102 Encrypted powershell cmdline option found 24->102 104 Injects a PE file into a foreign processes 24->104 34 Hwqujbjwlyvggktrainingadministrator_s.exe 24->34         started        37 powershell.exe 24->37         started        64 80.66.87.20, 49698, 80 WORLDSTREAMNL Russian Federation 28->64 66 api.ip.sb 28->66 106 Tries to harvest and steal browser information (history, passwords, etc) 28->106 108 Tries to steal Crypto Currency Wallets 28->108 39 conhost.exe 30->39         started        signatures14 process15 signatures16 74 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 34->74 76 Maps a DLL or memory area into another process 34->76 78 Checks if the current machine is a virtual machine (disk enumeration) 34->78 80 Creates a thread in another existing process (thread injection) 34->80 41 explorer.exe 34->41 injected 46 conhost.exe 37->46         started        process17 dnsIp18 68 manctelayaller.com 188.116.36.174, 80 HSAE Poland 41->68 52 C:\Users\user\AppData\Roaming\gcfsabs, PE32 41->52 dropped 110 System process connects to network (likely due to code injection or exploit) 41->110 112 Benign windows process drops PE files 41->112 114 Hides that the sample has been downloaded from the Internet (zone.identifier) 41->114 file19 signatures20
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0/
Threat name:
Win64.Trojan.Privateloader
Create hunting rule
Status:
Malicious
First seen:
2022-10-15 21:26:56 UTC
File Type:
PE+ (Exe)
Extracted files:
26
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=plkve6fifbo2zzn3mnzurzmzbq2wu7bvxpfy4lkt7u64mrlt2taa._file
Verdict:
malicious
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:redline family:smokeloader botnet:nigh backdoor discovery infostealer persistence spyware stealer trojan
Link:
https://tria.ge/reports/221016-gtq6gahab3/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks computer location settings
Reads user/profile data of web browsers
Executes dropped EXE
Detects Smokeloader packer
RedLine
RedLine payload
SmokeLoader
Malware Config
C2 Extraction:
80.66.87.20:80
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/1d9df058-5dc2-4d4a-a73b-ea3c4ac8f0c8
Unpacked files
SH256 hash:
7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0
MD5 hash:
c34729173ecc820eb7674431597d78be
SHA1 hash:
884f343876a8bb0ebac63c28191c22c6f69590f8
Link:
https://www.unpac.me/results/6f6c09f9-2b9c-43b6-9efa-92b9bf0f7fd8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2346029/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/320639/

Comments