MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b85681390582857c1bbc99136f8b2467d373627328129f639e8f4509ad26f81. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7b85681390582857c1bbc99136f8b2467d373627328129f639e8f4509ad26f81
SHA3-384 hash: de200f4026cb47968ce0f82e95a8198950b69aea89b78a7705c8ea55f6c050649d831ff41d0b96adfbd8d953f65bb066
SHA1 hash: 7c940b8cc4362e318e70f7729b7993bf1fc39bd9
MD5 hash: 639657f671fb64b658944658569a0d09
humanhash: delta-blue-earth-stairway
File name:639657f671fb64b658944658569a0d09.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:866'304 bytes
First seen:2020-05-26 15:21:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 24576:FAHnh+eWsN3skA4RV1Hom2KXMmHa/dg5:0h+ZkldoPK8Ya/w
Threatray 771 similar samples on MalwareBazaar
TLSH 52058B0273D1C036FFABA2739B6AF60556BC79254133852F13981DB9BD701B2263E663
Reporter abuse_ch
Tags:exe Smoke Loader


Avatar
abuse_ch
Smoke Loader payload URL:
http://paste.ee/r/Y3pKh

Smoke Loader C2:
http://britbox.us/a/

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Script-PowerShell.Trojan.Povertel
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 15:35:42 UTC
File Type:
PE (Exe)
Extracted files:
22
AV detection:
23 of 31 (74.19%)
Threat level:
  2/5
Verdict:
unknown
Similar samples:
1288e82cd94277f4fa087f5f8f7c8aaefda56da0f734953321e1b45cb3046951
Smoke Loader
15d88e59e80b15ed7b24ffd1a496ff718b76a6a7d06cc2be0d1f91e460871c12
Smoke Loader
342c79ff62a16ad618c837f19efa7362a7f06403b5eb405ca667048d90344945
Smoke Loader
4f1d9a967da00fdf547491027d2a3d1fc60cd6b3ad216786505c1405e7a07f08
Smoke Loader
8de876c0766f3590a1e8c5b2ff94d40ec95a093167292dfa07c4c82da173cce6
Smoke Loader
970ffc480d61b37737f34ddf738e257a99162cce8338f7c59fdd4ab995ae9dfc
Smoke Loader
c0e957bd685417a90c9a53b926e2492a627b247357648d2a3857c6ce61630e20
Smoke Loader
c130572887aeccb97dc53750a4b5693c43fdf6eb17974fc993d79daf6068842b
Smoke Loader
d4cbdf9fbbdcb9271298d6fd7be1c430fa7b675948020f7766f1377bdee629c5
Smoke Loader
f13513c8b2e9f663d86a33c0d86179aa25ae600b1fac25b79b7767b99be9b177
Smoke Loader
+ 761 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-ynb3rq9fya/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in System32 directory
Blacklisted process makes network request
Malware Config
Dropper Extraction:
httP://paste.ee/r/Y3pKh
httPs://paste.ee/r/47v7E
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 7b85681390582857c1bbc99136f8b2467d373627328129f639e8f4509ad26f81

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/366360/
  
Delivery method
Distributed via web download

Comments