MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f2cfb1ea3c8286893af1458145cd69f9fd4d6021c542178c1f3f4ceac7fff33. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7f2cfb1ea3c8286893af1458145cd69f9fd4d6021c542178c1f3f4ceac7fff33
SHA3-384 hash: 191e53c67ed723500477c13b3c29bf58568447be337d92967a4b4587004dfb12c5300deb0f24c7f064a5bbe6b44329eb
SHA1 hash: 5ff60f41075c26fc958cb156f5202fdceff5a567
MD5 hash: c60426959f80d927d00ef4711e78cea6
humanhash: nitrogen-kilo-missouri-blossom
File name:c60426959f80d927d00ef4711e78cea6
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:224'256 bytes
First seen:2022-10-13 12:29:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a1b373e7ca3fda2ce442bdf8c326bfda (2 x Smoke Loader, 2 x RedLineStealer)
ssdeep 6144:xQ63jeLHURdxzRWy0CA/FhQQohCKjPHSq:xH6edxzDA/qhJB
Threatray 7'883 similar samples on MalwareBazaar
TLSH T11024C02336D0C072E26A16748C11DAF46BBFB8715975A68B3BD40AAC4F353E2DE25347
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 9a9acafecee6eaee (53 x Smoke Loader, 24 x Amadey, 14 x RedLineStealer)
Reporter zbetcheckin
Tags:32 exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
206
Origin country :
n/a
Vendor Threat Intelligence
Detection:
SmokeLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/319930/
Detection(s):
Win.Packed.Dropperx-9973281-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Searching for synchronization primitives
Sending a custom TCP request
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Sending an HTTP POST request
Sending an HTTP GET request
Query of malicious DNS domain
Sending a TCP request to an infection source
Unauthorized injection to a system process
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm greyware packed
Link:
https://www.filescan.io/uploads/634804cb35923f9ad982d1d9/reports/b2f3931e-a703-45af-80ec-2a8573d8da4b/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8fdd0ba2-c0ab-4e0e-9610-c11246c2034f
Result
Threat name:
DanaBot, SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1089819
Signature
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to detect sleep reduction / modifications
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect virtualization through RDTSC time measurements
Yara detected DanaBot stealer dll
Yara detected SmokeLoader
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 722429 Sample: pRHeQav0XC.exe Startdate: 13/10/2022 Architecture: WINDOWS Score: 100 44 Snort IDS alert for network traffic 2->44 46 Multi AV Scanner detection for domain / URL 2->46 48 Malicious sample detected (through community Yara rule) 2->48 50 7 other signatures 2->50 9 pRHeQav0XC.exe 2->9         started        12 gtguwwc 2->12         started        14 579.exe 2->14         started        process3 signatures4 70 Detected unpacking (changes PE section rights) 9->70 72 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 9->72 74 Maps a DLL or memory area into another process 9->74 16 explorer.exe 6 9->16 injected 76 Machine Learning detection for dropped file 12->76 78 Checks if the current machine is a virtual machine (disk enumeration) 12->78 80 Creates a thread in another existing process (thread injection) 12->80 process5 dnsIp6 38 187.156.51.92, 49698, 49703, 49713 UninetSAdeCVMX Mexico 16->38 40 46.194.108.30, 49702, 49711, 49712 TELENOR-NEXTELTelenorNorgeASNO Sweden 16->40 42 7 other IPs or domains 16->42 30 C:\Users\user\AppData\Roaming\gtguwwc, PE32 16->30 dropped 32 C:\Users\user\AppData\Local\Temp\6001.exe, PE32 16->32 dropped 34 C:\Users\user\AppData\Local\Temp\579.exe, PE32 16->34 dropped 36 C:\Users\user\...\gtguwwc:Zone.Identifier, ASCII 16->36 dropped 52 System process connects to network (likely due to code injection or exploit) 16->52 54 Benign windows process drops PE files 16->54 56 Deletes itself after installation 16->56 58 Hides that the sample has been downloaded from the Internet (zone.identifier) 16->58 21 6001.exe 16->21         started        24 579.exe 16->24         started        file7 signatures8 process9 signatures10 60 Multi AV Scanner detection for dropped file 21->60 62 Detected unpacking (changes PE section rights) 21->62 64 Detected unpacking (overwrites its own PE header) 21->64 68 2 other signatures 21->68 26 7za.exe 1 21->26         started        66 Machine Learning detection for dropped file 24->66 process11 process12 28 conhost.exe 26->28         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7f2cfb1ea3c8286893af1458145cd69f9fd4d6021c542178c1f3f4ceac7fff33/
Threat name:
Win32.Trojan.Raccoon
Create hunting rule
Status:
Malicious
First seen:
2022-10-13 12:30:07 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p4wpwhvdzaugre5pcrmbixgwt6p5jvqcdrkcc6gb6p2m5ld774zq._file
Verdict:
malicious
Similar samples:
0c6facd04ff638eca0f124a85d70a58afbf0f3aab6e9848a3ed4f327fc003f3c
Smoke Loader
1d93a0ed3ada10f0c36024e54df1dd9fb39aca60bde33ad4d4083a97e0ffbd0c
Smoke Loader
37d782a8cc1be5558cb62e686b5d460313167ac6bd84b78f6496e8d8c0454806
Smoke Loader
63a8ab528ed934ca28ef397a4cdb1c05cb7e939e9f0a289cf82fc8d2a72aa4e1
Smoke Loader
b596fe7648820623b127a3480b32e29dce554070b2ae937bf44aa48cfdfc38cd
Smoke Loader
cf998f3442e8da6a3582bea41447bda575e688073cd798cb9e41d62727a2c6df
Smoke Loader
d302cf5509a9972eb558ad079c2ecb5293b71449321ba023be8392ecb92dc03f
Smoke Loader
+ 7'873 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:danabot family:smokeloader backdoor banker spyware stealer trojan
Link:
https://tria.ge/reports/221013-ppf4psdgdp/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Modifies Internet Explorer settings
Modifies registry class
Modifies system certificate store
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Suspicious use of SetThreadContext
Enumerates connected drives
Reads user/profile data of web browsers
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Danabot
Detects Smokeloader packer
SmokeLoader
Malware Config
C2 Extraction:
192.236.233.188:443
192.119.70.159:443
23.106.124.171:443
213.227.155.103:443
49.0.50.0:57
51.0.52.0:0
53.0.54.0:1200
55.0.56.0:65535
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/bdf564bb-2649-4e3f-8798-7cd16f110c64
Unpacked files
SH256 hash:
7a68135c35a476c25bf3b1a0a8eba83b8d2a1b1cf62fa09ed837cdb1bf570455
MD5 hash:
4a9dc069af235d03ec5aaa2b6293b56a
SHA1 hash:
2d1dcdc8146cf01a56b154a54616c263f0e84bdd
Detections:
win_smokeloader_a2
Create hunting rule
SmokeLoaderStage2
Create hunting rule
Link:
https://www.unpac.me/results/043d20a7-f277-4d20-87ce-4df2bdb1366c/
Parent samples :
3ff3bd0a125b24b53520ec9ccc0e16d9e0950600ba527754fd194fb1d6a8d099
81e077a7be1719d015dac668d244e423639aab2481ab4dc85965ed3e9149e4f9
7f2cfb1ea3c8286893af1458145cd69f9fd4d6021c542178c1f3f4ceac7fff33
71cb880a73d0cb7eb933a93be2b6bb9ee394a2cda1f0f5e882d5bfc83f4e0609
1d3f37d2989eed7acee995c28e8cb9010ef54c45a4ccf84be54d036388a24ab5
a2bc5e03ed38aaafe284d8b29d896ae2708ca03fc2c732bb986bf50411b08f0a
5d15f594dee648ecd97cc2fbc66ee349991ec6ebd040f49439be2ac81f792fa8
67076dd399a7a1ba3f6218f67b6241100241d51c5d8b9d79bec7631db0fe3aff
498ed30ab0b8d3a1378c1d2096099cd494d7543d87be39c8f207120e611babc4
7f18e1325f88bd8421a03d3d88ad25e2c9e6ff80e39e97efaa7f4d372b3be4dd
4ce542d14230b8774aef2b7b7336070404ce1e530b0df045a874d0d1e514fc41
SH256 hash:
7f2cfb1ea3c8286893af1458145cd69f9fd4d6021c542178c1f3f4ceac7fff33
MD5 hash:
c60426959f80d927d00ef4711e78cea6
SHA1 hash:
5ff60f41075c26fc958cb156f5202fdceff5a567
Link:
https://www.unpac.me/results/043d20a7-f277-4d20-87ce-4df2bdb1366c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7f2cfb1ea3c8286893af1458145cd69f9fd4d6021c542178c1f3f4ceac7fff33

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 7f2cfb1ea3c8286893af1458145cd69f9fd4d6021c542178c1f3f4ceac7fff33

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/319930/
  
URLhaus
https://urlhaus.abuse.ch/url/2365784/

Comments


Avatar
zbet commented on 2022-10-13 12:29:24 UTC

url : hxxp://pelegisr.com/upload/ChromeSetup.exe