MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 82361af8f5303de90ff5757d8dbba87b8fc00fc0ea7b6fb922517c8078e71bdb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 82361af8f5303de90ff5757d8dbba87b8fc00fc0ea7b6fb922517c8078e71bdb
SHA3-384 hash: 97741848c34466dcd65ed25ff9de861c221672f9b60251126c9b6f3cd61052b2bdde41bd446506a267257f4fbc3d233f
SHA1 hash: b09930f39b658639f06c83a6111be4c93ef712f8
MD5 hash: 762d276b402209a5ce78d9a9258f1bd3
humanhash: five-blossom-sink-spaghetti
File name:762d276b402209a5ce78d9a9258f1bd3.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:279'040 bytes
First seen:2022-10-11 08:20:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4cea7ae85c87ddc7295d39ff9cda31d1 (85 x RedLineStealer, 71 x LummaStealer, 62 x Rhadamanthys)
ssdeep 1536:kI47GyTGCwiSnmQUt0LB1Qk7s5gMbwo1pv+uiR7UutEseagS:kvGyYiSDnt1Qx5so1Yv
Threatray 14'159 similar samples on MalwareBazaar
TLSH T1AC540A8173948457F8975A304E93C7AAD728FC82AA30765B2360F74F4A3BED26F64705
TrID 70.8% (.CPL) Windows Control Panel Item (generic) (197083/11/60)
15.4% (.EXE) InstallShield setup (43053/19/16)
5.9% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
3.7% (.EXE) Win64 Executable (generic) (10523/12/4)
1.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon 008cb2b2aab2b600 (1 x Smoke Loader, 1 x RedLineStealer)
Reporter abuse_ch
Tags:exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
209
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/318846/
Detection(s):
SecuriteInfo.com.decompression.bomb.29185.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Creating a window
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Sending a custom TCP request
Launching a process
Unauthorized injection to a recently created process
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/42460/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
EvasionQueryPerformanceCounter
EvasionGetTickCount
Verdict:
Malicious
Threat level:
  10/10
Confidence:
80%
Tags:
advpack.dll rundll32.exe setupapi.dll shell32.dll
Link:
https://www.filescan.io/uploads/634527707a6f3f03619db64e/reports/c11a60cb-0594-46af-bcbd-3eee85019ec7/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/03bc74a1-b068-44b0-ab9b-ce5964264834
Result
Threat name:
RedLine, SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1087865
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Encrypted powershell cmdline option found
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Costura Assembly Loader
Yara detected RedLine Stealer
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 720443 Sample: T1sdbmoDSZ.exe Startdate: 11/10/2022 Architecture: WINDOWS Score: 100 60 Snort IDS alert for network traffic 2->60 62 Malicious sample detected (through community Yara rule) 2->62 64 Antivirus / Scanner detection for submitted sample 2->64 66 7 other signatures 2->66 9 T1sdbmoDSZ.exe 1 3 2->9         started        12 rundll32.exe 2->12         started        process3 file4 38 C:\Users\user\AppData\Local\...\SETUP_~1.EXE, PE32 9->38 dropped 14 SETUP_~1.EXE 15 5 9->14         started        process5 dnsIp6 48 fortuitousopportunities.com 173.236.189.74, 443, 49687, 49690 DREAMHOST-ASUS United States 14->48 50 images.pexels.com 104.17.209.102, 443, 49685, 49686 CLOUDFLARENETUS United States 14->50 40 C:\...\Qpuenibvqqkchnxvqbrformsyndrome_s.exe, PE32 14->40 dropped 52 Antivirus detection for dropped file 14->52 54 Multi AV Scanner detection for dropped file 14->54 56 Machine Learning detection for dropped file 14->56 58 2 other signatures 14->58 19 Qpuenibvqqkchnxvqbrformsyndrome_s.exe 14 4 14->19         started        23 SETUP_~1.EXE 2 14->23         started        25 powershell.exe 15 14->25         started        file7 signatures8 process9 dnsIp10 42 fortuitousopportunities.com 19->42 44 images.pexels.com 19->44 68 Multi AV Scanner detection for dropped file 19->68 70 Machine Learning detection for dropped file 19->70 72 Encrypted powershell cmdline option found 19->72 27 Qpuenibvqqkchnxvqbrformsyndrome_s.exe 19->27         started        30 powershell.exe 19->30         started        46 89.208.106.66, 4691, 49691, 49692 PSKSET-ASRU Russian Federation 23->46 32 conhost.exe 25->32         started        signatures11 process12 signatures13 74 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 27->74 76 Maps a DLL or memory area into another process 27->76 78 Checks if the current machine is a virtual machine (disk enumeration) 27->78 34 explorer.exe 27->34 injected 36 conhost.exe 30->36         started        process14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/82361af8f5303de90ff5757d8dbba87b8fc00fc0ea7b6fb922517c8078e71bdb/
Threat name:
Win64.Spyware.RedLine
Create hunting rule
Status:
Malicious
First seen:
2022-10-11 03:58:23 UTC
File Type:
PE+ (Exe)
Extracted files:
179
AV detection:
21 of 42 (50.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qi3bv6hvga66sd7vov6y3o5ipoh4ad6a5j5w7ojckf6ia6hhdpnq._file
Verdict:
malicious
Similar samples:
224f2f24e7b2522fbe762b705c5a783a085f45428d81524705e8f06680c1003e
Smoke Loader
81128156f0d23dbf2258a881c82b57778c964f5fc73fb3584652153955876a2e
Smoke Loader
8f4ccb41b24de4d077f55f9f33455424bafa4f7546bc4f55efb77c94f9877170
Smoke Loader
932536b82f2cfdf2cc26698715b96844cf597170d7110ae80674122a9a647891
Smoke Loader
9579f141b148827a8307419bfe076a7e9ab2f21665b8dd8467ca480be1365d49
Smoke Loader
a0cba475149fc1ca51c519472d1cf7fe1f8f8aa749f6b593295cdb8782ff10d3
Smoke Loader
b5412319c25e53df63fc1905a347841ea97771a33bd8743da76a4bf6ae83c455
Smoke Loader
b78d348dc8a28e80d79acd9118ea488c502a18c30b211a03edd4cfd59715090f
Smoke Loader
d313b8135e205855351aaac9bbf73299973bb82caa43ab9862838d07926bf740
Smoke Loader
+ 14'149 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:redline family:smokeloader botnet:volka backdoor infostealer persistence trojan
Link:
https://tria.ge/reports/221011-j8z32adgf7/
Behaviour
Checks SCSI registry key(s)
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
Detects Smokeloader packer
RedLine
RedLine payload
SmokeLoader
Malware Config
C2 Extraction:
89.208.106.66:4691
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/73ef0ae3-a791-444d-b0ea-03ac888fff0a
Unpacked files
SH256 hash:
82361af8f5303de90ff5757d8dbba87b8fc00fc0ea7b6fb922517c8078e71bdb
MD5 hash:
762d276b402209a5ce78d9a9258f1bd3
SHA1 hash:
b09930f39b658639f06c83a6111be4c93ef712f8
Link:
https://www.unpac.me/results/d518cf97-8208-4702-b2c9-790f70d3d72c/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/82361af8f530/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/82361af8f5303de90ff5757d8dbba87b8fc00fc0ea7b6fb922517c8078e71bdb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 82361af8f5303de90ff5757d8dbba87b8fc00fc0ea7b6fb922517c8078e71bdb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2359902/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/318846/

Comments