MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 856ef7f611f594731015621e730d9713ae59824f3280703bd3c7de5ba8884767. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 856ef7f611f594731015621e730d9713ae59824f3280703bd3c7de5ba8884767
SHA3-384 hash: 0ccbfaa2814a7dd9825f633ac9b9cee0de39acac065232ddd67a88cd14dfa30b69aa86871497a159276804b543d72d05
SHA1 hash: b3d00bc0101730c0ea1fd56cc71eb6d2c98ee452
MD5 hash: 664cebf0ad01f705db5497f1f114ffa4
humanhash: utah-march-seventeen-monkey
File name:856ef7f611f594731015621e730d9713ae59824f3280703bd3c7de5ba8884767.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:1'467'392 bytes
First seen:2022-05-26 08:08:38 UTC
Last seen:2022-05-26 08:13:21 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 24576:PVm7oNOw4DdSJ9I3dWApGdQyCSh69PArIfO0wyAVoteJOk/Kj28CB3SbqWdRVKT:P07hSHI3RpnSh4zbwVueJOk/LB3So
Threatray 12 similar samples on MalwareBazaar
TLSH T17C652213E93EA736D21832322818BB512B303DBB153FD25F3296784B9977701AF79925
TrID 38.0% (.EXE) Win64 Executable (generic) (10523/12/4)
23.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
16.3% (.EXE) Win32 Executable (generic) (4505/5/1)
7.3% (.EXE) OS/2 Executable (generic) (2029/13)
7.2% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon 00231d5101010100 (3 x Amadey, 2 x SpectreRAT, 1 x QuasarRAT)
Reporter Finch39487976
Tags:EternityWorm exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
342
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
856ef7f611f594731015621e730d9713ae59824f3280703bd3c7de5ba8884767.exe
Verdict:
Malicious activity
Analysis date:
2022-05-26 08:09:03 UTC
Tags:
loader
Link:
https://app.any.run/tasks/4d39194a-e64b-41c5-8c1d-33214b4e25a2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Emotet
Create hunting rule
Link:
https://www.capesandbox.com/analysis/274682/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.20279.UNOFFICIAL
Create hunting rule

Win.Packed.Msilheracles-9943143-0
Create hunting rule

Win.Packed.Lazy-9946657-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Сreating synchronization primitives
Launching a process
Searching for synchronization primitives
Creating a window
Searching for the window
Sending a custom TCP request
Launching a service
Creating a file
Changing a file
Delayed writing of the file
Creating a process from a recently created file
DNS request
Sending an HTTP GET request
Unauthorized injection to a recently created process
Query of malicious DNS domain
Sending an HTTP GET request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/628f35b5054dcf0ecaf0afd6/reports/778a750f-9adb-46dd-9385-8f7f5eb40a1d/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Eternity Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0aa959b0-9f77-480f-9958-f1bc53fd3791
Result
Threat name:
Unknown
Detection:
malicious
Classification:
rans.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1001995
Signature
Antivirus detection for URL or domain
Found Tor onion address
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Modifies existing user documents (likely ransomware behavior)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Obfuscated command line found
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Very long command line found
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 634491 Sample: 1D7o0dMoeX.exe Startdate: 26/05/2022 Architecture: WINDOWS Score: 100 52 soapbeginshops.com 2->52 64 Multi AV Scanner detection for domain / URL 2->64 66 Malicious sample detected (through community Yara rule) 2->66 68 Antivirus detection for URL or domain 2->68 70 5 other signatures 2->70 12 1D7o0dMoeX.exe 1 4 2->12         started        signatures3 process4 file5 46 C:\Users\user\AppData\Local\Temp\logo.exe, PE32 12->46 dropped 48 C:\Users\user\AppData\...\1D7o0dMoeX.exe.log, ASCII 12->48 dropped 15 logo.exe 18 86 12->15         started        process6 dnsIp7 54 soapbeginshops.com 34.118.86.4, 49770, 49791, 49819 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 15->54 38 C:\Users\user\DesktopIVQSAOTAQ.exe, PE32 15->38 dropped 40 C:\Users\user\DesktopFOYFBOLXA.exe, PE32 15->40 dropped 42 C:\Users\user\DesktopEGWXUHVUG.exe, PE32 15->42 dropped 44 75 other files (37 malicious) 15->44 dropped 56 Modifies existing user documents (likely ransomware behavior) 15->56 20 unarchiver.exe 5 15->20         started        file8 signatures9 process10 process11 22 cmd.exe 2 20->22         started        24 7za.exe 2 20->24         started        process12 26 powershell.exe 19 22->26         started        28 conhost.exe 22->28         started        30 conhost.exe 24->30         started        process13 32 mshta.exe 16 26->32         started        dnsIp14 50 soapbeginshops.com 32->50 58 Suspicious powershell command line found 32->58 60 Obfuscated command line found 32->60 62 Very long command line found 32->62 36 powershell.exe 32->36         started        signatures15 process16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/856ef7f611f594731015621e730d9713ae59824f3280703bd3c7de5ba8884767/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-05-25 06:36:21 UTC
File Type:
PE (.Net Exe)
Extracted files:
16
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
034e8e297165eeb14372eea7a7e68756e561df39b84c5be924e542a36dee7418
Smoke Loader
0ae6223a947654283ddaad72ab64c82c6a4dbd3e7fb367a4914e6acc01785e78
Smoke Loader
65c863db26f4ad804cb65ecf86f5d3b0b7dc961979544fe059192f6caab4c861
Smoke Loader
757eb1dc48fc181b770984905c3ec14c7be9c8f9bdf813108417e318479051f5
Smoke Loader
7c0790ce5a7cfd7a3ab0af70a4766b7003bdf8eb2e366f5c74f609c57c34f4bb
Smoke Loader
b247599ef98b9e9144954a5c41083cdd1e46854a54b46e25b7fc729045345f63
Smoke Loader
b4ac41c87a05e54cdd6b31132994860cf61bc0ab2f04a8c7ff65ef3f585becf5
Smoke Loader
f1c5be0df761f43d265a1e7057f59a05b1f78f3bafabd7a9145fe195fc6db97a
Smoke Loader
fd64e524e0f85d83e28e36f15bcb4033b508abcb3695c02612f56e4122b8beb7
Smoke Loader
+ 2 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/220526-j14q9ahfh8/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Loads dropped DLL
Downloads MZ/PE file
Executes dropped EXE
Unpacked files
SH256 hash:
a36e5c8960f27edfe6faac02d2b5912317dce0b9ab558378680303e1b15503de
MD5 hash:
90261f729f296a8a65488286f9c52df1
SHA1 hash:
a75e01a587ba922b186d9eab167bddfcd29decc5
Link:
https://www.unpac.me/results/e561fb97-4eda-4a68-b220-a46c14065dfa/
SH256 hash:
7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a
MD5 hash:
944ce5123c94c66a50376e7b37e3a6a6
SHA1 hash:
a1936ac79c987a5ba47ca3d023f740401f73529b
Link:
https://www.unpac.me/results/e561fb97-4eda-4a68-b220-a46c14065dfa/
SH256 hash:
48f144f744a9ce60659ee8cc7094610252aecbabf95492fbc612db919d144918
MD5 hash:
d9e08ec1c571d8139255cf305e3fef40
SHA1 hash:
72aea7c18c901a3246eb276258e3b37a95048b4e
Link:
https://www.unpac.me/results/e561fb97-4eda-4a68-b220-a46c14065dfa/
SH256 hash:
22d656a93589f45df7c71039fe808541105dc6927bca733933b67fa4843863f3
MD5 hash:
a5cb23b8b71b2eec6cf53c89a166d1ca
SHA1 hash:
954152dabcfebfd04143c97eb814ffdcf9f622da
Link:
https://www.unpac.me/results/e561fb97-4eda-4a68-b220-a46c14065dfa/
SH256 hash:
856ef7f611f594731015621e730d9713ae59824f3280703bd3c7de5ba8884767
MD5 hash:
664cebf0ad01f705db5497f1f114ffa4
SHA1 hash:
b3d00bc0101730c0ea1fd56cc71eb6d2c98ee452
Link:
https://www.unpac.me/results/e561fb97-4eda-4a68-b220-a46c14065dfa/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/856ef7f611f5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/856ef7f611f594731015621e730d9713ae59824f3280703bd3c7de5ba8884767

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Smoke Loader

Executable exe 856ef7f611f594731015621e730d9713ae59824f3280703bd3c7de5ba8884767

(this sample)

Smoke Loader

Executable exe af5379419906d8162669c4809ca28cdc4a4b656658c94f1ba18afb29437e699f

Smoke Loader

HTML Application (hta) hta 249df49fd640dc7efbfc27fc2eb836bcff0090557f1b65bb710645cea68c296f

Smoke Loader

zip 608d90507e8477ca85b911f790799f13f8d04cc380d346b78358237a9480de6d

Cape
Cape
https://www.capesandbox.com/analysis/274682/
  
Dropping
SHA256 608d90507e8477ca85b911f790799f13f8d04cc380d346b78358237a9480de6d
  
Dropping
MD5 4027a41cc4f3d834e8f9091a0f55641f

Comments