MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 831fc1d8df2be45780ee06e59dabb36b787c3f26f544b67688cfa91c10f5dbbf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 831fc1d8df2be45780ee06e59dabb36b787c3f26f544b67688cfa91c10f5dbbf
SHA3-384 hash: 2a35f4bccabed65282b4e558cf3b63312e75dcb9fe5f7a597e3842b80ed41f4574ed42dfb15d3232aefb546ae3da1e1a
SHA1 hash: 09e8721f89a1726f357ace4220ae24761567b794
MD5 hash: becdce3289da746b1132421f1bb9b5c8
humanhash: seven-india-juliet-kitten
File name:file
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:1'229'024 bytes
First seen:2023-10-03 11:39:17 UTC
Last seen:2023-10-04 19:13:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e74c8ae3503a17604f2a2d84ae3389c4 (4 x AgentTesla, 2 x SnakeKeylogger, 1 x DarkCloud)
ssdeep 24576:gptqA4nuEzNQOrc1AYiVdIl/bOkdHZRyMj/y0YhvJ8GHvKb4:MgDnuExQOrhYi7q/bOkd5RyMj3Yh+g24
TLSH T1ED4533C87646F088C9F3A634958D68C2EBA92F3553544C227D3A71E338D7F71A977806
TrID 64.7% (.EXE) UPX compressed Win64 Executable (70117/5/12)
25.0% (.EXE) UPX compressed Win32 Executable (27066/9/6)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
1.8% (.EXE) OS/2 Executable (generic) (2029/13)
1.8% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter andretavare5
Tags:exe signed Smoke Loader

Code Signing Certificate

Organisation:Microsoft Code Signing PCA 2011
Issuer:Microsoft Code Signing PCA 2011
Algorithm:sha256WithRSAEncryption
Valid from:2023-10-03T11:29:03Z
Valid to:2024-10-03T11:29:03Z
Serial number: 82cb470fe804d29f1ba89ec8e0d30593
Thumbprint Algorithm:SHA256
Thumbprint: dbc02b0f8c0d0a885b147857d60375bc5347d7edb695ebd8534d1dc7087f5acd
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
andretavare5
Sample downloaded from http://185.225.74.144/files/Umm2.exe

Intelligence

File Origin
# of uploads :
34
# of downloads :
327
Origin country :
US US
Vendor Threat Intelligence
Malware family:
redline
Create hunting rule
ID:
1
File name:
https://itfolkstechnology.com/wp-download/zip.7z
Verdict:
Malicious activity
Analysis date:
2023-10-03 15:55:53 UTC
Tags:
privateloader evasion opendir loader gcleaner risepro stealer lumma stealc redline tofsee botnet onlylogger hijackloader amadey trojan smoke fabookie ransomware stop raccoon recordbreaker danabot danabot-unpacked raccoonclipper vidar arkei g0njxa
Link:
https://app.any.run/tasks/03df17a0-3267-4e12-aa3f-94288002d285

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.FileRepMalware.32660.6436.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
Сreating synchronization primitives
DNS request
Sending a custom TCP request
Connecting to a non-recommended domain
Sending an HTTP GET request
Creating a file
Creating a process from a recently created file
Creating a process with a hidden window
Using the Windows Management Instrumentation requests
Creating a file in the %temp% subdirectories
Creating a window
Searching for synchronization primitives
Launching cmd.exe command interpreter
Delayed reading of the file
Running batch commands
Launching the default Windows debugger (dwwin.exe)
Blocking the User Account Control
Unauthorized injection to a recently created process
Query of malicious DNS domain
Sending a TCP request to an infection source
Unauthorized injection to a recently created process by context flags manipulation
Launching a tool to kill processes
Adding an exclusion to Microsoft Defender
Unauthorized injection to a system process
Sending an HTTP GET request to an infection source
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Gathering data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
hacktool overlay packed packed packed upx
Link:
https://www.filescan.io/uploads/651bfd935befb75cf35f9480/reports/f2828a94-0e8a-41ca-a86c-ef87dafa35ab/overview
Verdict:
Malicious
Labled as:
Ser.Lazy.Generic
Link:
https://www.hybrid-analysis.com/sample/831fc1d8df2be45780ee06e59dabb36b787c3f26f544b67688cfa91c10f5dbbf
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/b4b53407-8a0f-4233-8517-3450c8befdd6
Result
Threat name:
Amadey, SmokeLoader, Xmrig, onlyLogger
Create hunting rule
Detection:
malicious
Classification:
spre.phis.troj.adwa.spyw.expl.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1318650
Signature
Adds a directory exclusion to Windows Defender
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Contains functionality to modify clipboard data
Creates a thread in another existing process (thread injection)
Creates an undocumented autostart registry key
Creates files in the system32 config directory
Creates HTML files with .exe extension (expired dropper behavior)
Detected unpacking (changes PE section rights)
Disables UAC (registry)
Drops script or batch files to the startup folder
Found hidden mapped module (file has been removed from disk)
Found malware configuration
Infects executable files (exe, dll, sys, html)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies power options to not sleep / hibernate
Modifies the context of a thread in another process (thread injection)
Modifies the hosts file
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Protects its processes via BreakOnTermination flag
Sample is not signed and drops a device driver
Sample uses string decryption to hide its real strings
Sigma detected: Drops script at startup location
Sigma detected: Stop multiple services
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Instant Messenger accounts or passwords
Uses powercfg.exe to modify the power settings
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Amadey bot
Yara detected Amadeys Clipper DLL
Yara detected Amadeys stealer DLL
Yara detected Generic Downloader
Yara detected onlyLogger
Yara detected SmokeLoader
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1318650 Sample: file.exe Startdate: 03/10/2023 Architecture: WINDOWS Score: 100 136 Multi AV Scanner detection for domain / URL 2->136 138 Found malware configuration 2->138 140 Malicious sample detected (through community Yara rule) 2->140 142 18 other signatures 2->142 12 file.exe 1 2->12         started        15 updater.exe 2->15         started        18 cmd.exe 2->18         started        20 5 other processes 2->20 process3 file4 172 Allocates memory in foreign processes 12->172 174 Adds a directory exclusion to Windows Defender 12->174 176 Disables UAC (registry) 12->176 22 InstallUtil.exe 15 343 12->22         started        27 InstallUtil.exe 12->27         started        29 powershell.exe 17 12->29         started        118 C:\Windows\Temp\vzfjseeodhka.tmp, PE32+ 15->118 dropped 120 C:\Windows\Temp\fpsprjlqcfim.sys, PE32+ 15->120 dropped 178 Protects its processes via BreakOnTermination flag 15->178 180 Injects code into the Windows Explorer (explorer.exe) 15->180 182 Writes to foreign memory regions 15->182 190 3 other signatures 15->190 184 Uses powercfg.exe to modify the power settings 18->184 186 Modifies power options to not sleep / hibernate 18->186 31 conhost.exe 18->31         started        33 sc.exe 18->33         started        35 sc.exe 18->35         started        39 3 other processes 18->39 188 Creates files in the system32 config directory 20->188 37 conhost.exe 20->37         started        41 6 other processes 20->41 signatures5 process6 dnsIp7 126 85.217.144.143 WS171-ASRU Bulgaria 22->126 128 5.42.64.10 RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU Russian Federation 22->128 130 28 other IPs or domains 22->130 90 C:\Users\...\zGLVSyr3lieKwWkUrKVibfRf.exe, PE32 22->90 dropped 92 C:\Users\...\yptETVGqfq2qI3hG0DRY8GNG.exe, PE32+ 22->92 dropped 94 C:\Users\...\ymwfjfATlQ1x2kcVEIn9cxvy.exe, PE32 22->94 dropped 96 266 other malicious files 22->96 dropped 144 Infects executable files (exe, dll, sys, html) 22->144 43 UX0P5YlAJlwQd2iTdnUGgRYH.exe 22->43         started        47 H0T8qmc33UYShhnAc4Hi7ByG.exe 22->47         started        49 ajPURNrTju7klgxDAuGVGGah.exe 22->49         started        53 7 other processes 22->53 146 Drops script or batch files to the startup folder 27->146 148 Creates HTML files with .exe extension (expired dropper behavior) 27->148 51 conhost.exe 29->51         started        file8 signatures9 process10 dnsIp11 106 C:\Users\user\AppData\Local\...\nhdues.exe, PE32 43->106 dropped 192 Contains functionality to inject code into remote processes 43->192 56 nhdues.exe 43->56         started        194 Detected unpacking (changes PE section rights) 47->194 196 Injects a PE file into a foreign processes 47->196 61 H0T8qmc33UYShhnAc4Hi7ByG.exe 47->61         started        108 C:\Program Filesbehaviorgraphoogle\Chrome\updater.exe, PE32+ 49->108 dropped 110 C:\Windows\System32\drivers\etc\hosts, ASCII 49->110 dropped 198 Modifies the hosts file 49->198 200 Adds a directory exclusion to Windows Defender 49->200 122 142.250.31.132 GOOGLEUS United States 53->122 124 172.253.63.102 GOOGLEUS United States 53->124 112 C:\Users\user\AppData\...\9582477640.exe, PE32 53->112 dropped 114 C:\Users\user\AppData\Local\...\s51[1], PE32 53->114 dropped 116 C:\Users\user\AppData\Local\...\s51[1], PE32 53->116 dropped file12 signatures13 process14 dnsIp15 132 193.42.32.29 EENET-ASEE Germany 56->132 98 C:\Users\user\AppData\Roaming\...\cred64.dll, PE32+ 56->98 dropped 100 C:\Users\user\AppData\Roaming\...\clip64.dll, PE32 56->100 dropped 102 C:\Users\user\AppData\Local\...\cred64[1].dll, PE32+ 56->102 dropped 104 C:\Users\user\AppData\Local\...\clip64[1].dll, PE32 56->104 dropped 158 Multi AV Scanner detection for dropped file 56->158 160 Creates an undocumented autostart registry key 56->160 162 Uses schtasks.exe or at.exe to add and modify task schedules 56->162 63 rundll32.exe 56->63         started        66 cmd.exe 56->66         started        68 schtasks.exe 56->68         started        70 rundll32.exe 56->70         started        164 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 61->164 166 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 61->166 168 Maps a DLL or memory area into another process 61->168 170 2 other signatures 61->170 file16 signatures17 process18 signatures19 202 Contains functionality to modify clipboard data 63->202 72 rundll32.exe 63->72         started        76 conhost.exe 66->76         started        78 cmd.exe 66->78         started        80 cacls.exe 66->80         started        84 4 other processes 66->84 82 conhost.exe 68->82         started        process20 dnsIp21 134 109.206.241.33 AWMLTNL Germany 72->134 150 System process connects to network (likely due to code injection or exploit) 72->150 152 Tries to steal Instant Messenger accounts or passwords 72->152 154 Tries to harvest and steal ftp login credentials 72->154 156 Tries to harvest and steal browser information (history, passwords, etc) 72->156 86 tar.exe 72->86         started        signatures22 process23 process24 88 conhost.exe 86->88         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/831fc1d8df2be45780ee06e59dabb36b787c3f26f544b67688cfa91c10f5dbbf/
Threat name:
Win64.Trojan.Znyonm
Create hunting rule
Status:
Malicious
First seen:
2023-10-03 11:40:06 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
14 of 23 (60.87%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qmp4dwg7fpsfpahoa3sz3k5tnn4hypzg6vclm5uiz6uryehv3o7q._file
Verdict:
unknown
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:amadey family:danabot family:fabookie family:glupteba family:smokeloader botnet:pub1 backdoor banker dropper evasion loader spyware stealer trojan upx
Link:
https://tria.ge/reports/231003-nsvwlaac6w/
Behaviour
Creates scheduled task(s)
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System policy modification
Program crash
Launches sc.exe
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
.NET Reactor proctector
Drops startup file
UPX packed file
Downloads MZ/PE file
Stops running service(s)
Amadey
Danabot
Detect Fabookie payload
Fabookie
Glupteba
Glupteba payload
SmokeLoader
UAC bypass
Malware Config
C2 Extraction:
http://193.42.32.29/9bDc8sQ/index.php
http://host-file-host6.com/
http://host-host-file8.com/
http://app.nnnaajjjgc.com/check/safe
Unpacked files
SH256 hash:
411809d1ba8fc946b5883afd62a5525c03cafbbb6a1a373e4100fbdb5a607cce
MD5 hash:
3ce6ffb30aa14c4d579dbb2c70903958
SHA1 hash:
7541ab09152ca509297ab314534cb05d13142b44
Link:
https://www.unpac.me/results/9ec4f7d2-db60-4139-90ee-2048288023b5/
SH256 hash:
831fc1d8df2be45780ee06e59dabb36b787c3f26f544b67688cfa91c10f5dbbf
MD5 hash:
becdce3289da746b1132421f1bb9b5c8
SHA1 hash:
09e8721f89a1726f357ace4220ae24761567b794
Link:
https://www.unpac.me/results/9ec4f7d2-db60-4139-90ee-2048288023b5/
Malware family:
Amadey
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/831fc1d8df2b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/831fc1d8df2be45780ee06e59dabb36b787c3f26f544b67688cfa91c10f5dbbf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:PE_Potentially_Signed_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:shad0w_beacon_16June
Create hunting rule
Author:SBousseaden
Description:Shad0w beacon compressed
Reference:https://github.com/bats3c/shad0w

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
PrivateLoader
  
Delivery method
Distributed via drive-by
  
URLhaus
https://urlhaus.abuse.ch/url/2715393/

Comments