MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 854d167ff218c5caa012baaa7bb80a2bfdd1ec9c4c6b3a66bef57240ade29422. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 854d167ff218c5caa012baaa7bb80a2bfdd1ec9c4c6b3a66bef57240ade29422
SHA3-384 hash: f5ece207e3190d058fc9a31bc355b0de5e5c69d46dec54026aa9fd9a45626313c3e977279b2c0c8584ca447a1d542c83
SHA1 hash: a79813ed17faa8da9bed564957e7eda5cb49d5ea
MD5 hash: 150845a95eb238bb0b72d9f9b7d31f63
humanhash: fillet-equal-coffee-magnesium
File name:8190f821195f3047bdba44fb309dd111
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:246'272 bytes
First seen:2020-11-17 12:33:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash a2e739735836bc488ceaf7ddd738e8fe (4 x Bunitu, 3 x Tofsee, 1 x RedLineStealer)
ssdeep 3072:gSewtVh1RyqPRyn1IjagRwZNb1W2xuUzLZ98AlFre7dJfT2fPjjjjjjjj2:gSzHuqROI2HZNJtusN9dbrSdJfTsu
Threatray 329 similar samples on MalwareBazaar
TLSH FF34AE10F6E3C572C0A3443C4420D290663BBC66EAB4C98F77943B5A2EB16D16BB7376
Reporter seifreed
Tags:Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Generickdz-9784859-0
Create hunting rule

Win.Dropper.Tofsee-9785157-0
Create hunting rule

Win.Packed.Generickdz-9785340-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file in the %temp% directory
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Connection attempt to an infection source
Deleting of the original file
Enabling autorun by creating a file
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/854d167ff218c5caa012baaa7bb80a2bfdd1ec9c4c6b3a66bef57240ade29422/
Threat name:
Win32.Trojan.Glupteba
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 12:37:52 UTC
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qvgrm77sddc4viasxkvhxoakfp65d3e4jrvtuzv66vzeblpcsqra._file
Verdict:
malicious
Similar samples:
13f9aaf463af2f611a36afe435ba5f3518f4583ce0b2d6e2a493a6f89c961e53
Smoke Loader
218333bd24c8318b23dd2c9579df008329219ef3841a9bcbc17b4a725c075cae
Smoke Loader
352f3584318b67778fd06d1d96962117d12cff0a5945b6ae8825e2c1bbdf8b8c
Smoke Loader
3f5236a82af731f886881c3e9abafe621e40b481b220f0b7639387860f795c16
Smoke Loader
59a7beab1c7583b7995b157e9e87beb6fa0785c49784bf0b9d13bd143a696541
Smoke Loader
5c0a5184329fafa9ef105ad31e3163c3c94c3433d4c0882c4a03ffdd2d16c75e
Smoke Loader
77d3172d77aa45c61b8563dcb13b26bd2f8f9fb4cbc2fcc966966a26f316ba56
Smoke Loader
ca4f7d501b768375a9d3f839eb87a1c824f1c9dfdef9f8863332318523ba652a
Smoke Loader
de79f76f370c9eaa2f7fc5b169f414860d283607fdc4ea9b3980b31cf211da03
Smoke Loader
e964b2343b3f9b9f2fe25d4af384ceceeea24e5402622c449487019a9eab21ac
Smoke Loader
+ 319 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla family:redline family:smokeloader backdoor infostealer keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201117-5trz1lk3ta/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Gathers network information
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of UnmapMainImage
Suspicious use of SetThreadContext
JavaScript code in executable
Looks up external IP address via web service
Deletes itself
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
AgentTesla Payload
SmokeLoader
AgentTesla
RedLine
Malware Config
C2 Extraction:
http://10022020newfolder1002002131-service1002.space/
http://10022020newfolder1002002231-service1002.space/
http://10022020newfolder3100231-service1002.space/
http://10022020newfolder1002002431-service1002.space/
http://10022020newfolder1002002531-service1002.space/
http://10022020newfolder33417-01242510022020.space/
http://10022020test125831-service1002012510022020.space/
http://10022020test136831-service1002012510022020.space/
http://10022020test147831-service1002012510022020.space/
http://10022020test146831-service1002012510022020.space/
http://10022020test134831-service1002012510022020.space/
http://10022020est213531-service100201242510022020.ru/
http://10022020yes1t3481-service1002012510022020.ru/
http://10022020test13561-service1002012510022020.su/
http://10022020test14781-service1002012510022020.info/
http://10022020test13461-service1002012510022020.net/
http://10022020test15671-service1002012510022020.tech/
http://10022020test12671-service1002012510022020.online/
http://10022020utest1341-service1002012510022020.ru/
http://10022020uest71-service100201dom2510022020.ru/
http://10022020test61-service1002012510022020.website/
http://10022020test51-service1002012510022020.xyz/
http://10022020test41-service100201pro2510022020.ru/
http://10022020yest31-service100201rus2510022020.ru/
http://10022020rest21-service1002012510022020.eu/
http://10022020test11-service1002012510022020.press/
http://10022020newfolder4561-service1002012510022020.ru/
http://10022020rustest213-service1002012510022020.ru/
http://10022020test281-service1002012510022020.ru/
http://10022020test261-service1002012510022020.space/
http://10022020yomtest251-service1002012510022020.ru/
http://10022020yirtest231-service1002012510022020.ru/
Unpacked files
SH256 hash:
854d167ff218c5caa012baaa7bb80a2bfdd1ec9c4c6b3a66bef57240ade29422
MD5 hash:
150845a95eb238bb0b72d9f9b7d31f63
SHA1 hash:
a79813ed17faa8da9bed564957e7eda5cb49d5ea
Link:
https://www.unpac.me/results/e85cc5d9-183b-4e51-9f5c-62b510c796ae/
SH256 hash:
140bb7e37a486d3125e800fa72cc6ccabb7ad2975879bbb05bc7c011a8ac329f
MD5 hash:
994aa96c668e878787a18dc3310f2bee
SHA1 hash:
fdfbf69b95ef50ea52b9e67f7a8d1b801ea3a343
Link:
https://www.unpac.me/results/e85cc5d9-183b-4e51-9f5c-62b510c796ae/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments