MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8113159e0ac7c44fb49f3231ea9541e2d9ce9fd06dee9887037349e3370e6e73. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 15


Intelligence 15 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8113159e0ac7c44fb49f3231ea9541e2d9ce9fd06dee9887037349e3370e6e73
SHA3-384 hash: cb1ee34b3ae15fc66d9a36b335e3e1dda0a15ce971f7aa3cdccd8614b3dfb6502333dccdd00f27aef71938a2ec01cf5b
SHA1 hash: 2a3926bd9f3440ba9780e60487353c5419da0701
MD5 hash: 9babf546962a147ee1c5b50d0313fd38
humanhash: hotel-white-shade-zebra
File name:9babf546962a147ee1c5b50d0313fd38
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:236'032 bytes
First seen:2023-06-19 08:15:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e22f6bb2be4e12044608fc1a03b29b46 (2 x Smoke Loader, 2 x GCleaner, 1 x SystemBC)
ssdeep 3072:Sy0j+8JYhONZkk00oT1QqQk33uU2sKsXFNn+hYNIExQMW2oAYwj5:qjzKhONCk0f1QqNH52iFN+SN/Q2m
Threatray 4'892 similar samples on MalwareBazaar
TLSH T193349ED272A0EC70D1251B724D2EE6F92A5DFD708F24679BE2087A1F19BC2A1C572353
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 006060684a6a7420 (1 x Smoke Loader)
Reporter zbetcheckin
Tags:32 exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
302
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
smoke
Create hunting rule
ID:
1
File name:
9babf546962a147ee1c5b50d0313fd38
Verdict:
Malicious activity
Analysis date:
2023-06-19 08:17:30 UTC
Tags:
loader smoke trojan stealer
Link:
https://app.any.run/tasks/201e4b16-70c3-49e7-a099-761a17245428

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
SmokeLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/400341/
Detection(s):
SecuriteInfo.com.Win32.CrypterX-gen.12027.20567.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Sending an HTTP POST request
Launching a process
Reading critical registry keys
Creating a file in the %temp% directory
Сreating synchronization primitives
Searching for synchronization primitives
Creating a process from a recently created file
Setting browser functions hooks
Unauthorized injection to a system process
Stealing user critical data
Enabling autorun by creating a file
Unauthorized injection to a browser process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
80%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/64900ec73bd1514efdffe2b3/reports/26bdaab1-e4d1-46d2-b3c3-fbfb8d1c934e/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/8113159e0ac7c44fb49f3231ea9541e2d9ce9fd06dee9887037349e3370e6e73
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/ed65ec4f-4190-429b-a898-d4ef0cb6da07
Result
Threat name:
SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
bank.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1257811
Signature
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if browser processes are running
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to compare user and computer (likely to detect sandboxes)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Found evasive API chain (may stop execution after checking mutex)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 890827 Sample: VKzL0p8iXx.exe Startdate: 20/06/2023 Architecture: WINDOWS Score: 100 40 Found malware configuration 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 4 other signatures 2->46 7 VKzL0p8iXx.exe 2->7         started        10 rajtjjc 2->10         started        process3 signatures4 48 Detected unpacking (changes PE section rights) 7->48 50 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 7->50 52 Maps a DLL or memory area into another process 7->52 54 Creates a thread in another existing process (thread injection) 7->54 12 explorer.exe 1 4 7->12 injected 56 Multi AV Scanner detection for dropped file 10->56 58 Machine Learning detection for dropped file 10->58 60 Checks if the current machine is a virtual machine (disk enumeration) 10->60 process5 dnsIp6 30 suprememax.ga 185.173.39.106, 49720, 80 ECO-ASRU Russian Federation 12->30 26 C:\Users\user\AppData\Roaming\rajtjjc, PE32 12->26 dropped 28 C:\Users\user\...\rajtjjc:Zone.Identifier, ASCII 12->28 dropped 62 System process connects to network (likely due to code injection or exploit) 12->62 64 Benign windows process drops PE files 12->64 66 Injects code into the Windows Explorer (explorer.exe) 12->66 68 3 other signatures 12->68 17 explorer.exe 6 12->17         started        20 explorer.exe 12->20         started        22 explorer.exe 12->22         started        24 4 other processes 12->24 file7 signatures8 process9 signatures10 32 Found evasive API chain (may stop execution after checking mutex) 17->32 34 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 17->34 36 Tries to steal Mail credentials (via file / registry access) 17->36 38 3 other signatures 17->38
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8113159e0ac7c44fb49f3231ea9541e2d9ce9fd06dee9887037349e3370e6e73/
Threat name:
Win32.Trojan.RedLine
Create hunting rule
Status:
Malicious
First seen:
2023-06-19 07:51:40 UTC
File Type:
PE (Exe)
Extracted files:
37
AV detection:
19 of 24 (79.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qejrlhqky7ce7ne7giy6vfkb4lm45h6qnxxjrbydone6gnyonzzq._file
Verdict:
malicious
Similar samples:
0ab54468721453d7237df27d4dd6383366edb5cc3bfab9a20d48a2416ca2aed8
Smoke Loader
13cb91350d3dbbb3a647e84ec450bf3c5e068a30ee6801bc8b94c136d47f52de
Smoke Loader
1793cad04147480c4cbe70e6046e8ae0403320927b54e5efd276f7f6efc40bd9
Smoke Loader
42c8c439618026e2a94e526c32bc6fbe680f638a3e2b3442201725739d921eac
Smoke Loader
43f8d48262990c633247fe9940ce1af9268ef44f1e1a7d9a865c8df69710d4f2
Smoke Loader
51f7cb2bce2460bec286f14978cb796e6858be4335c10401a1fb9e54893cca92
Smoke Loader
d896e1c6f1124eb8cf19f29d2dec8d35203cfd4ea36636549e178a1a06de10db
Smoke Loader
db6a96013bdb32a1b2b0a13f276ce211cccd906e73ec324573c2ed8be69bf2ab
Smoke Loader
de8385440c23789f44c418bdf2e30578559b1c6b142c820f081f81280d1c0888
Smoke Loader
+ 4'882 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor collection trojan
Link:
https://tria.ge/reports/230619-j548ksdg5v/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
outlook_win_path
Accesses Microsoft Outlook profiles
SmokeLoader
Malware Config
C2 Extraction:
http://suprememax.ga/
http://bloomberg.ga/
Unpacked files
SH256 hash:
0d1951f30938c16071c93a0b4c1081245b94236181012e93faad06fdcf3838dc
MD5 hash:
ee0e4eff207e538c0a67848818d89cfd
SHA1 hash:
af73c67b37e5a4265988b7b368cf5b18d3328746
Detections:
SmokeLoaderStage2
Create hunting rule
win_smokeloader_a2
Create hunting rule
Link:
https://www.unpac.me/results/5c680a42-f361-448e-9814-997fc6454364/
Parent samples :
2c4cefea32bcd7a2b3fce9441b265f7c4aa36a7dc54ddf4964a6b799266760cf
8113159e0ac7c44fb49f3231ea9541e2d9ce9fd06dee9887037349e3370e6e73
d896e1c6f1124eb8cf19f29d2dec8d35203cfd4ea36636549e178a1a06de10db
57c2cea33c310ad66d76c408ba1437f59f2172e77a96f353f568fa9ec8854a35
b010a749d181fa2a1ad4bf78d84043a1fa334900029b86947a11990a6cb1db3e
4fce1d0099d746c09f6e7a8ae41882cbb95070ab24843b1516b8a74ce65d3701
9e6ce673dc161fc54b110782f18ec9bb3690b9ccdde494196ccb5bb0381dfa94
SH256 hash:
8113159e0ac7c44fb49f3231ea9541e2d9ce9fd06dee9887037349e3370e6e73
MD5 hash:
9babf546962a147ee1c5b50d0313fd38
SHA1 hash:
2a3926bd9f3440ba9780e60487353c5419da0701
Link:
https://www.unpac.me/results/5c680a42-f361-448e-9814-997fc6454364/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8113159e0ac7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8113159e0ac7c44fb49f3231ea9541e2d9ce9fd06dee9887037349e3370e6e73

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 8113159e0ac7c44fb49f3231ea9541e2d9ce9fd06dee9887037349e3370e6e73

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/400341/
  
URLhaus
https://urlhaus.abuse.ch/url/2665972/

Comments


Avatar
zbet commented on 2023-06-19 08:15:35 UTC

url : hxxp://192.3.101.139/255/DaHosts.exe