MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7d5dff7be7a6f4b4d39ca0f4bc39bc5bcf00f6ac0e8fb42f7fcedea1239de30a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7d5dff7be7a6f4b4d39ca0f4bc39bc5bcf00f6ac0e8fb42f7fcedea1239de30a
SHA3-384 hash: a1ede141c6f838b4eb13c8e85d4b3496d7449df5d5f8f4b00de14b109bdffa9355c8634eb0b30362f485c322e1c260c2
SHA1 hash: 486e490e8803274a115186b72eaba6da44122c86
MD5 hash: 8144e93bdffac95244255185627e77a3
humanhash: orange-lima-mobile-network
File name:8144e93bdffac95244255185627e77a3.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:215'552 bytes
First seen:2021-07-15 09:41:21 UTC
Last seen:2021-07-15 11:21:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d1b7adb65c8c567c9bfcf4aec7318593 (1 x CryptBot, 1 x RedLineStealer, 1 x Smoke Loader)
ssdeep 3072:tEH1BJlmp60sovOFO0yU5+huCQcWYm8wNS3E:tcBZF5bpYF90
Threatray 982 similar samples on MalwareBazaar
TLSH T15524AE5076B0D837E2A20AB02575C7A02A3BFD626970BD0F36573E5F5E322C1756A387
Reporter abuse_ch
Tags:Dofoil exe Smoke Loader

Intelligence

File Origin
# of uploads :
2
# of downloads :
216
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8144e93bdffac95244255185627e77a3.exe
Verdict:
Suspicious activity
Analysis date:
2021-07-15 09:44:51 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5550ab28-6c05-453d-9a85-3c975238965a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DLInjector01
Create hunting rule
Link:
https://www.capesandbox.com/analysis/171932/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.19288.343.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
RedLine stealer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3c70d328-bd50-4a50-87c3-43a6dea50bcd
Result
Threat name:
Djvu Raccoon RedLine SmokeLoader Tofsee
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/816822
Signature
.NET source code contains very large strings
Adds a directory exclusion to Windows Defender
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
DLL reload attack detected
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Renames NTDLL to bypass HIPS
Sigma detected: Powershell Defender Exclusion
Sigma detected: WannaCry Ransomware
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to resolve many domain names, but no domain seems valid
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file access)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Djvu Ransomware
Yara detected Raccoon Stealer
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Tofsee
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 449232 Sample: 3IL88iBPym.exe Startdate: 15/07/2021 Architecture: WINDOWS Score: 100 106 www.instagram.com 2->106 108 fastpool.xyz 2->108 110 9 other IPs or domains 2->110 148 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->148 150 Multi AV Scanner detection for domain / URL 2->150 152 Sigma detected: WannaCry Ransomware 2->152 156 14 other signatures 2->156 12 3IL88iBPym.exe 2->12         started        15 haiiebv 2->15         started        17 svchost.exe 1 2->17         started        19 5 other processes 2->19 signatures3 154 Tries to resolve many domain names, but no domain seems valid 106->154 process4 dnsIp5 172 DLL reload attack detected 12->172 174 Detected unpacking (changes PE section rights) 12->174 176 Contains functionality to inject code into remote processes 12->176 22 3IL88iBPym.exe 1 12->22         started        178 Injects a PE file into a foreign processes 15->178 25 haiiebv 1 15->25         started        180 System process connects to network (likely due to code injection or exploit) 17->180 112 api.2ip.ua 19->112 signatures6 process7 file8 158 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 22->158 160 Renames NTDLL to bypass HIPS 22->160 162 Maps a DLL or memory area into another process 22->162 28 explorer.exe 11 22->28 injected 90 C:\Users\user\AppData\Local\Temp\AE30.tmp, PE32 25->90 dropped 164 Checks if the current machine is a virtual machine (disk enumeration) 25->164 166 Creates a thread in another existing process (thread injection) 25->166 signatures9 process10 dnsIp11 122 999080321yomtest251-service10020125999080321.ru 28->122 124 999080321yirtest231-service10020125999080321.ru 28->124 126 84 other IPs or domains 28->126 96 C:\Users\user\AppData\Roaming\haiiebv, PE32 28->96 dropped 98 C:\Users\user\AppData\Local\Temp\8E04.exe, PE32 28->98 dropped 100 C:\Users\user\AppData\Local\Temp\3BC.exe, PE32+ 28->100 dropped 102 3 other files (1 malicious) 28->102 dropped 184 System process connects to network (likely due to code injection or exploit) 28->184 186 Benign windows process drops PE files 28->186 188 Performs DNS queries to domains with low reputation 28->188 192 2 other signatures 28->192 33 8E04.exe 1 28->33         started        37 C5E9.exe 28->37         started        40 3BC.exe 2 5 28->40         started        42 9 other processes 28->42 file12 190 Tries to resolve many domain names, but no domain seems valid 124->190 signatures13 process14 dnsIp15 72 C:\Users\user\AppData\Local\Temp\1105.tmp, PE32 33->72 dropped 128 DLL reload attack detected 33->128 130 Detected unpacking (changes PE section rights) 33->130 132 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 33->132 146 4 other signatures 33->146 114 telete.in 195.201.225.248, 443, 49760 HETZNER-ASDE Germany 37->114 116 34.89.184.90, 49761, 80 GOOGLEUS United States 37->116 74 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 37->74 dropped 86 58 other files (none is malicious) 37->86 dropped 134 Detected unpacking (overwrites its own PE header) 37->134 136 Tries to steal Mail credentials (via file access) 37->136 76 C:\Users\user\AppData\...\MicrosoftApi.exe, PE32+ 40->76 dropped 78 C:\Users\user\...\ICSharpCode.SharpZipLib.dll, PE32 40->78 dropped 138 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 40->138 44 MicrosoftApi.exe 1 5 40->44         started        118 116.202.183.50, 49766, 80 HETZNER-ASDE Germany 42->118 120 sslamlssa1.tumblr.com 74.114.154.18, 443, 49765 AUTOMATTICUS Canada 42->120 80 C:\Users\user\AppData\Local\...\bltfxuda.exe, PE32 42->80 dropped 82 C:\Users\user\AppData\...\vcruntime140[1].dll, PE32 42->82 dropped 84 C:\Users\user\AppData\...\mozglue[1].dll, PE32 42->84 dropped 88 10 other files (none is malicious) 42->88 dropped 140 Tries to harvest and steal browser information (history, passwords, etc) 42->140 142 Tries to steal Crypto Currency Wallets 42->142 144 Injects a PE file into a foreign processes 42->144 48 FC5D.exe 42->48         started        51 AFFE.exe 15 2 42->51         started        53 conhost.exe 42->53         started        file16 signatures17 process18 dnsIp19 92 C:\Users\user\AppData\...\tmp8EB0.tmp.cmd, DOS 44->92 dropped 182 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 44->182 55 cmd.exe 44->55         started        58 cmd.exe 44->58         started        104 api.2ip.ua 77.123.139.190, 443, 49764, 49768 VOLIA-ASUA Ukraine 48->104 94 C:\Users\user\AppData\Local\...\FC5D.exe, PE32 48->94 dropped file20 signatures21 process22 signatures23 168 Uses schtasks.exe or at.exe to add and modify task schedules 55->168 170 Adds a directory exclusion to Windows Defender 55->170 60 conhost.exe 55->60         started        62 timeout.exe 55->62         started        64 powershell.exe 55->64         started        66 conhost.exe 58->66         started        68 timeout.exe 58->68         started        70 schtasks.exe 58->70         started        process24
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7d5dff7be7a6f4b4d39ca0f4bc39bc5bcf00f6ac0e8fb42f7fcedea1239de30a/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-07-15 09:42:08 UTC
AV detection:
26 of 28 (92.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pvo7667hu32lju44ud2lyon4lphqb5vmb2h3il37z3pkci454mfa._file
Verdict:
malicious
Label(s):
masslogger
Create hunting rule
Similar samples:
1b7769f85c3874451b85f83ab1ddc08b0d07fe76f354e0c7b397308894095673
Smoke Loader
451ce50988cfa9b6a5c51cc0cfab60a40694f06f83b31ca168225256e223e5a7
Smoke Loader
4a0ecbcf9b54ed1c9654eb9ee214a797f48c980c6d03a261f62fa9671a2733d6
Smoke Loader
63761462358e1f880dafe51b3de8036f10bc60354b981cddc8075aed22e1251d
Smoke Loader
71c0a6fb3c31d1fa82fb99ddda7811810d9bf6306ce7e3377547035fe6b512f2
Smoke Loader
8b7e447356ade4824db0565f713751a6c0b37cc560269ced9cc6176e1d1fdd24
Smoke Loader
948bae9510601455f2ba50d694a6561bf2e85071b86161a0186672616ae17a77
Smoke Loader
ae42b792d1a162e7d48b4717ea810bc20772aa64df184b9301c56c6509810408
Smoke Loader
ae7ae9ea7fd0100b620704d462083caaedda2c5c5618ceeca54c1d7673b6be4a
Smoke Loader
b148a9228e806a666a057a6d69180ed21dbdc26ee28e754b00e98efdcae15c66
Smoke Loader
+ 972 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:raccoon family:redline family:smokeloader family:tofsee family:vidar family:xmrig botnet:517 botnet:824 botnet:bibi botnet:q backdoor discovery evasion infostealer miner persistence spyware stealer themida trojan
Link:
https://tria.ge/reports/210715-zzcxw8v4s6/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Kills process with taskkill
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Launches sc.exe
Drops file in System32 directory
Suspicious use of NtCreateThreadExHideFromDebugger
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Looks up external IP address via web service
Checks BIOS information in registry
Deletes itself
Loads dropped DLL
Modifies file permissions
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Themida packer
Creates new service(s)
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
Sets service image path in registry
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Vidar Stealer
XMRig Miner Payload
Raccoon
RedLine
RedLine Payload
SmokeLoader
Suspicious use of NtCreateProcessExOtherParentProcess
Tofsee
Vidar
Windows security bypass
xmrig
Malware Config
C2 Extraction:
http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
http://999080321test61-service10020125999080321.website/
http://999080321test51-service10020125999080321.xyz/
http://999080321test41-service100201pro25999080321.ru/
http://999080321yest31-service100201rus25999080321.ru/
http://999080321rest21-service10020125999080321.eu/
http://999080321test11-service10020125999080321.press/
http://999080321newfolder4561-service10020125999080321.ru/
http://999080321rustest213-service10020125999080321.ru/
http://999080321test281-service10020125999080321.ru/
http://999080321test261-service10020125999080321.space/
http://999080321yomtest251-service10020125999080321.ru/
http://999080321yirtest231-service10020125999080321.ru/
http://nusurtal4f.net/
http://netomishnetojuk.net/
http://escalivrouter.net/
http://nick22doom4.net/
http://wrioshtivsio.su/
http://nusotiso4.su/
http://rickkhtovkka.biz/
http://palisotoliso.net/
45.32.235.238:45555
https://sslamlssa1.tumblr.com/
https://olegf9844.tumblr.com/
45.147.230.79:12632
Unpacked files
SH256 hash:
40f733e06f7bcb4bd915fbd0c3fbb05ee571094c0999c0104b661e9de72b8ec2
MD5 hash:
cda6ff3c17a09d22225df0ae90c705dc
SHA1 hash:
d822189153fb12866cb798cbfbe198a7b40e62ca
Link:
https://www.unpac.me/results/02386f9c-4f38-4cfe-8636-eb3ae61aeba2/
SH256 hash:
7d5dff7be7a6f4b4d39ca0f4bc39bc5bcf00f6ac0e8fb42f7fcedea1239de30a
MD5 hash:
8144e93bdffac95244255185627e77a3
SHA1 hash:
486e490e8803274a115186b72eaba6da44122c86
Link:
https://www.unpac.me/results/02386f9c-4f38-4cfe-8636-eb3ae61aeba2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7d5dff7be7a6f4b4d39ca0f4bc39bc5bcf00f6ac0e8fb42f7fcedea1239de30a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_DLInjector01
Create hunting rule
Author:ditekSHen
Description:Detects specific downloader injector shellcode

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 7d5dff7be7a6f4b4d39ca0f4bc39bc5bcf00f6ac0e8fb42f7fcedea1239de30a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1453973/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/171932/

Comments