MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8577213832eecf00f77003ddf49fb6630af4906b10b350f9dd88a899d9720a98. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8577213832eecf00f77003ddf49fb6630af4906b10b350f9dd88a899d9720a98
SHA3-384 hash: ff51290edc745e6cb58e9246efef02c7f3715cdf6ad129130d170acbb508a75282f1151c88573fdeb5167032cc3359e0
SHA1 hash: c61f39308883cb870dab0f914f7223d29fbf1157
MD5 hash: a4fca7df26d7f644a70ff82fe603b062
humanhash: wisconsin-uniform-avocado-high
File name:a4fca7df26d7f644a70ff82fe603b062.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:190'464 bytes
First seen:2021-10-27 11:52:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b8ef4a428f658ada3d2d48117cace047 (5 x RedLineStealer, 2 x Smoke Loader, 1 x Formbook)
ssdeep 3072:ow5r1W2CdhrmaVLqAIAyH2RKcm8+G8XWOnDuVMO6P2+BwvHJ3/Rg:oGr14dhrNVIHHIKGH8TDynVP
Threatray 5'690 similar samples on MalwareBazaar
TLSH T1C814BE0073D0C475D476463148A6CEE15B2EBCF3DF3D8A4B278F366EAE752809A26356
File icon (PE):PE icon
dhash icon fcfcd4f4d4dcd8c0 (34 x RaccoonStealer, 21 x RedLineStealer, 8 x ArkeiStealer)
Reporter abuse_ch
Tags:exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/200501/
Detection(s):
Win.Trojan.Generic-9904327-0
Create hunting rule

Win.Trojan.Generic-9904328-0
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching the default Windows debugger (dwwin.exe)
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/61793da1db358dd15edfa162/reports/2eb1d62f-0389-466c-8505-d98a778b9a89/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/da4a9aac-9ff0-4846-80ef-72bf43f2bf2a
Result
Threat name:
RedLine SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/877699
Signature
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 510133 Sample: ETNDpEx5x0.exe Startdate: 27/10/2021 Architecture: WINDOWS Score: 100 53 Found malware configuration 2->53 55 Antivirus detection for URL or domain 2->55 57 Multi AV Scanner detection for submitted file 2->57 59 5 other signatures 2->59 7 ETNDpEx5x0.exe 2->7         started        10 rbfhwaw 2->10         started        12 rbfhwaw 2->12         started        process3 signatures4 75 Detected unpacking (changes PE section rights) 7->75 77 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 7->77 79 Maps a DLL or memory area into another process 7->79 14 explorer.exe 6 7->14 injected 81 Multi AV Scanner detection for dropped file 10->81 83 Machine Learning detection for dropped file 10->83 85 Checks if the current machine is a virtual machine (disk enumeration) 10->85 87 Creates a thread in another existing process (thread injection) 12->87 process5 dnsIp6 39 brandyjaggers.com 115.91.217.231, 49738, 49745, 49747 LGDACOMLGDACOMCorporationKR Korea Republic of 14->39 41 193.142.59.113, 49746, 49763, 80 HOSTSLICK-GERMANYNL Netherlands 14->41 43 6 other IPs or domains 14->43 27 C:\Users\user\AppData\Roaming\rbfhwaw, PE32 14->27 dropped 29 C:\Users\user\AppData\Local\Temp\DEF7.exe, PE32 14->29 dropped 31 C:\Users\user\AppData\Local\Temp\A047.exe, PE32 14->31 dropped 33 2 other malicious files 14->33 dropped 45 System process connects to network (likely due to code injection or exploit) 14->45 47 Benign windows process drops PE files 14->47 49 Deletes itself after installation 14->49 51 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->51 19 A047.exe 5 14->19         started        23 DEF7.exe 3 14->23         started        25 550C.exe 14->25         started        file7 signatures8 process9 dnsIp10 35 193.150.103.37, 29118, 49775 ASGENERALTELRU Russian Federation 19->35 61 Detected unpacking (changes PE section rights) 19->61 63 Detected unpacking (overwrites its own PE header) 19->63 65 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 19->65 67 Tries to steal Crypto Currency Wallets 19->67 37 185.215.113.29, 36224, 49790 WHOLESALECONNECTIONSNL Portugal 23->37 69 Machine Learning detection for dropped file 23->69 71 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 23->71 73 Tries to harvest and steal browser information (history, passwords, etc) 23->73 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8577213832eecf00f77003ddf49fb6630af4906b10b350f9dd88a899d9720a98/
Threat name:
Win32.Trojan.Fragtor
Create hunting rule
Status:
Malicious
First seen:
2021-10-26 19:45:08 UTC
AV detection:
29 of 45 (64.44%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
4f153e6ce78056f92411d5ef40fd99926f4f0130b3050136307ed8d4e9276130
Smoke Loader
7e52d4da15fe2a58de032652081f0875c6edb3259033a50acccd288d3aa3d8dc
Smoke Loader
8cc8f28391efb0099a231da1df27d6acc2a9dbfdc11d536974eebb4bceba409a
Smoke Loader
97247f56010511a82492c3febbc0a1f2cbb0dae097178b76331373ed908a3434
Smoke Loader
b236e4c5839aa2bdbef8a9065e76c47809fc1fdfbd3058f2559f112c4b577cfc
Smoke Loader
f25d7dae55dc8c848e9fed3f218f886f4ca4412e5b94ae882c846c9b52a14046
Smoke Loader
+ 5'680 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:raccoon family:smokeloader botnet:9dc771dc7e85f59c03cb7b7e8b3457b079a2d538 backdoor stealer trojan
Link:
https://tria.ge/reports/211027-n2a8jsefd2/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
Deletes itself
Downloads MZ/PE file
Executes dropped EXE
Raccoon
SmokeLoader
Suspicious use of NtCreateProcessExOtherParentProcess
Malware Config
C2 Extraction:
http://brandyjaggers.com/upload/
http://andbal.com/upload/
http://alotofquotes.com/upload/
http://szpnc.cn/upload/
http://uggeboots.com/upload/
http://100klv.com/upload/
http://rapmusic.at/upload/
Unpacked files
SH256 hash:
f9b4b2e506fe88e1cd921a71c130a7e097bfb2dd1cfcec768b375c70ee6b800c
MD5 hash:
986d781d5e3181045ce6586b2b0af221
SHA1 hash:
8e21f86221892e43c95adfe05f385135fbf6886f
Link:
https://www.unpac.me/results/06c6821b-db3f-4b0f-bc9a-3ffc93107f4f/
SH256 hash:
8577213832eecf00f77003ddf49fb6630af4906b10b350f9dd88a899d9720a98
MD5 hash:
a4fca7df26d7f644a70ff82fe603b062
SHA1 hash:
c61f39308883cb870dab0f914f7223d29fbf1157
Link:
https://www.unpac.me/results/06c6821b-db3f-4b0f-bc9a-3ffc93107f4f/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/8577213832ee/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8577213832eecf00f77003ddf49fb6630af4906b10b350f9dd88a899d9720a98

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 8577213832eecf00f77003ddf49fb6630af4906b10b350f9dd88a899d9720a98

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1715225/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/200501/

Comments