MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 84ef2a0c4a530be1aecad44326446853d4a083a90f3a48fc4954f4a2460671d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 16

Intelligence 16 IOCs YARA 5 File information Comments 1

SHA256 hash:	84ef2a0c4a530be1aecad44326446853d4a083a90f3a48fc4954f4a2460671d6
SHA3-384 hash:	191c844c5cea248e23946ece6e78284c5b15f9745a4b64d0ea9c4dc13a667ff73c9094a7261e501a5923b4c02e529c31
SHA1 hash:	d8c319c6c5faf2815d897741ef89396a25f58a86
MD5 hash:	291f31bc765bcc17576d036d09a08071
humanhash:	sad-oxygen-three-paris
File name:	291f31bc765bcc17576d036d09a08071
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	265'216 bytes
First seen:	2023-10-21 19:47:44 UTC
Last seen:	2023-10-21 20:37:33 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	e917b644331755ce8f3ab54716b5cd3e (3 x Smoke Loader, 2 x Stealc, 1 x Tofsee)
ssdeep	3072:byBNpOKlAuHKSX3NCrtbQr3YRAyXeAyPkx6yApn93DW2K6wkJ:qmQAuqSXdMbC3UAQeAyPkxcJat3
Threatray	140 similar samples on MalwareBazaar
TLSH	T19C44BF1176D1C432E16769355870C6A61E3BBCF2EA7181CB37983E6EAE312D04B72B47
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	70d0dfd0d4c8d2dd (1 x Smoke Loader)
Reporter	zbetcheckin
Tags:	32 exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

328

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

291f31bc765bcc17576d036d09a08071

Verdict:

Malicious activity

Analysis date:

2023-10-21 19:49:00 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/e9199e5b-a2aa-4dfb-9102-a9fdb149a3dc

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.Siggen21.47298.15227.28848.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Сreating synchronization primitives

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Sending an HTTP POST request

Unauthorized injection to a system process

Enabling autorun by creating a file

Gathering data

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware

Link:

https://www.filescan.io/uploads/65342af5e3768e7905c539ce/reports/bfb0739d-0ffe-4d89-9acd-a4c518e28d8a/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/84ef2a0c4a530be1aecad44326446853d4a083a90f3a48fc4954f4a2460671d6

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/d2c4eae8-2f3b-4892-ae3c-d7ea51d164a6

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1329750

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/84ef2a0c4a530be1aecad44326446853d4a083a90f3a48fc4954f4a2460671d6

Detection:

smokeloader

Link:

https://mwdb.cert.pl/sample/84ef2a0c4a530be1aecad44326446853d4a083a90f3a48fc4954f4a2460671d6/

Threat name:

Win32.Trojan.Smokeloader

Status:

Malicious

First seen:

2023-10-21 19:48:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

14 of 22 (63.64%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qtxsudckkmf6dlwk2rbsmrdikpkkba5jb45er7cjkt2kerqgohla._file

Verdict:

malicious

Smoke Loader

0ef76ecabac1c81d4e2ed32c6fd30d846214f385a51523b4b78f105d9eb406a3

Smoke Loader

247eb6cc11d0a92ac985fb99c19dcfe4779878f4989764b8ced06727820ff57c

Smoke Loader

3b73c4da6f2bda6ebc26552afccbfd8c097a5a3195fd2593840d9ea7712b7120

Smoke Loader

5c88a340b3b0502c9777fe6159f01d66875341dc739e23a56a21ee18479890f2

Smoke Loader

6a302e65ae3cd7ceb6a94b2753f1a3223b189355eecbe443b0fd45722a495f48

Smoke Loader

a73ee8f46c7caf4da7ea6a92dc0a11d58757a83e1b5b9c3723b49690fc238271

Smoke Loader

e629fcf41de2187cafd4c8c38b1e9408a5c521d29459971bb96fae5da26fa9d5

Smoke Loader

ecacf78ad957224fcc0afbd65118f2b5e8e2eda5daef0e072eef35e5f12a43b3

Smoke Loader

+ 130 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader botnet:pub1 backdoor trojan

Link:

https://tria.ge/reports/231021-yh4e4ahe91/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Uses Task Scheduler COM API

Deletes itself

Executes dropped EXE

SmokeLoader

Malware Config

C2 Extraction:

http://wirtshauspost.at/tmp/
http://msktk.ru/tmp/
http://soetegem.com/tmp/
http://gromograd.ru/tmp/
http://talesofpirates.net/tmp/

Unpacked files

SH256 hash:

520163d1e3b4ac0b324cc02a1a63dde672cc11d2b7f5113993b04aa8c3ac0306

MD5 hash:

3c3fe2ea31124a0f22457207e5f84e79

SHA1 hash:

3ad3a6bcd05f431572f96bce57f3811f513d9be4

Detections:

SmokeLoaderStage2

win_smokeloader_a2

Link:

https://www.unpac.me/results/d776a792-2786-45c3-b2dc-0521d28390ef/

Parent samples :

1cf4b07955c77e1a4845a1da20bb2cb6d2d244bed78935ef6bec6512d9b5114b
8282c76d3fbe900b90d4cc171b116191362effd2ca851d3552742aabbf77ecf9
476e1c4ca9e0dff520effc75c48b7f3e349c73ab9e4d373646f40a570f846614
91c73aedcbfa2a3726a63259aafea1f73a89b54ad5ba5c2a1747d3927713449a
a675a625f52a13b54c0e28dcccbd6a4004ab262c841f42f9099d7e1b2d8091ff
1b7f969f6188c9980e47c97c8e7bc17588d3c96878baa1589cc3a739823e4b2a
eafe43d5f59f732f56db205872cd55690916a0b26874bb080ab752d86704b97d
ccc3d26959923a2d62322ecdeaa88011e3d29d90af69bc41196cfabe478389c5
aa7a7a2de7f49468905a4441b74991746cfcc9e0243d3874a13b6f76df1d7ec0
f59cc29cd0524b8adee549ec687aae0b9353be4ca5da1a84d62fc90aafaecfe2
84ef2a0c4a530be1aecad44326446853d4a083a90f3a48fc4954f4a2460671d6
bcd8f52b8001a64e39f3b0d2d19989527704d472f002c16e82e100eff38605a0

SH256 hash:

84ef2a0c4a530be1aecad44326446853d4a083a90f3a48fc4954f4a2460671d6

MD5 hash:

291f31bc765bcc17576d036d09a08071

SHA1 hash:

d8c319c6c5faf2815d897741ef89396a25f58a86

Link:

https://www.unpac.me/results/d776a792-2786-45c3-b2dc-0521d28390ef/

Malware family:

SmokeLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/84ef2a0c4a53/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/84ef2a0c4a530be1aecad44326446853d4a083a90f3a48fc4954f4a2460671d6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__ConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	pe_no_import_table Create hunting rule
Author:	qux
Description:	Detects exe does not have import table

Rule name:	Windows_Trojan_Smokeloader_3687686f Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

exe 84ef2a0c4a530be1aecad44326446853d4a083a90f3a48fc4954f4a2460671d6

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2712491/

URLhaus

https://urlhaus.abuse.ch/url/2712462/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-10-21 19:47:45 UTC

url : hxxps://advocaciasch.com.br/tmp/index.php