MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7fa11ed8064495f0a83c6fdf3136c6767f3eb49c4d7bdb7322ff90d08accee18. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 9

Intelligence 9 IOCs YARA File information Comments

SHA256 hash:	7fa11ed8064495f0a83c6fdf3136c6767f3eb49c4d7bdb7322ff90d08accee18
SHA3-384 hash:	0abef695e30f611a1d878ad25a47b5454994c800c9cdfd5721363b05b6e4896a7b4001f91e1b46081b4ddcbc2b138c16
SHA1 hash:	97cff55f5dffc1d956caeb1a5492b72a4f8a5469
MD5 hash:	2faec113d9e663803d2b5fb0df09b376
humanhash:	enemy-moon-winter-crazy
File name:	2faec113d9e663803d2b5fb0df09b376.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	268'800 bytes
First seen:	2021-10-04 10:29:57 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ea6e9add4feec4142f4eaf80b256f47a (2 x Smoke Loader, 2 x RaccoonStealer, 1 x Tofsee)
ssdeep	3072:bQ/tuH+nzLQy+0YYLmJ6w3q/PaQQUT3KYPhfsVBBQWvbvPQiaDhxxMeetkkrsC96:bQ/U2zLmv6qQB22U7ROhxxpeTr/ekI
Threatray	4'802 similar samples on MalwareBazaar
TLSH	T15744BE1931C0CBF2D6760570E7A6CBF40AEDFC6D4E56528F2B98271E5E383E19722252
File icon (PE):
dhash icon	fcfcb4d4d4dcd8c0 (14 x RedLineStealer, 11 x RaccoonStealer, 3 x Smoke Loader)
Reporter	abuse_ch
Tags:	Dofoil exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

185

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

2faec113d9e663803d2b5fb0df09b376.exe

Verdict:

Suspicious activity

Analysis date:

2021-10-04 10:35:40 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/fa1da88b-2178-4ddd-a034-d47629ea2d80

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/194554/

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e8840cbd-c0b5-4a74-ae89-8e1019289fd6

Result

Threat name:

Raccoon RedLine SmokeLoader Tofsee Vidar

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/863823

Signature

.NET source code contains potential unpacker

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

Antivirus detection for dropped file

Antivirus detection for URL or domain

Benign windows process drops PE files

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Connects to many ports of the same IP (likely port scanning)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Hides threads from debuggers

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Sigma detected: Copying Sensitive Files with Credential Data

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Uses known network protocols on non-standard ports

Yara detected Raccoon Stealer

Yara detected RedLine Stealer

Yara detected SmokeLoader

Yara detected Tofsee

Yara detected Vidar

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7fa11ed8064495f0a83c6fdf3136c6767f3eb49c4d7bdb7322ff90d08accee18/

Threat name:

Win32.Trojan.Fragtor

Status:

Malicious

First seen:

2021-10-04 10:30:21 UTC

AV detection:

27 of 45 (60.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=p6qr5wagisk7bkb4n7ptcnwgoz7t5ne4jv55w4zc76inbcwm5yma._file

Verdict:

malicious

Smoke Loader

04a77c819d0028948adb252dee0fec6618bf66c079086b9993267ddb7b1d70a6

Smoke Loader

2b1b66d7ab2022d41004937b8ea3d9f375364347b4f51d9d14bddc314296a1c5

Smoke Loader

44e29e5cd002e8d4d4f13432847f38fa79a1667b5fdef9b9f316c3501f3bb480

Smoke Loader

938029b6b522bdd22cbba8cfb88a1d97d0fbc264d1d7a5ded22a4924a15e6161

Smoke Loader

a1b29584402503925406ceeb5be6a463eea7755f401e3a2c8f82ae3897e3820a

Smoke Loader

e01749cfd587ae7029247ef900df2eb0e89e2fc594ca665d460a73bfa9564647

Smoke Loader

f2edf69ca64bb435d61ded2c3ca210d1bd19952c19275b7bd65d0d707fedadaa

Smoke Loader

f74d7500782ca945d3296cd4fcf19af60b7035ff65d646c64b0c8761e38ea193

Smoke Loader

fab15b7f61f816cf3128cc02c96d98d3385533087bc5afe3cd3799e7e034ce7f

Smoke Loader

+ 4'792 additional samples on MalwareBazaar

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:raccoon family:smokeloader family:tofsee family:vidar family:xmrig botnet:1015 botnet:5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4 botnet:61491ed5436f034714f70beac9b11914bfa969d2 backdoor discovery evasion miner persistence spyware stealer suricata themida trojan

Link:

https://tria.ge/reports/211004-mjwk4agcbj/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Creates scheduled task(s)

Delays execution with timeout.exe

Kills process with taskkill

Modifies data under HKEY_USERS

Modifies registry class

Modifies system certificate store

NTFS ADS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

NSIS installer

Enumerates physical storage devices

Program crash

Launches sc.exe

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses 2FA software files, possible credential harvesting

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks whether UAC is enabled

Legitimate hosting services abused for malware hosting/C2

Checks BIOS information in registry

Deletes itself

Drops startup file

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Themida packer

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Sets service image path in registry

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Vidar Stealer

XMRig Miner Payload

Raccoon

SmokeLoader

Tofsee

Vidar

Windows security bypass

suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)

suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt

xmrig

Malware Config

C2 Extraction:

http://fiskahlilian16.top/
http://paishancho17.top/
http://ydiannetter18.top/
http://azarehanelle19.top/
http://quericeriant20.top/
https://mas.to/@bardak1ho