MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 86d03866f50e32545514b56e8fc46122c136d24e80954b7f6291b870a1e2a5ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 17

Intelligence 17 IOCs YARA 1 File information Comments

SHA256 hash:	86d03866f50e32545514b56e8fc46122c136d24e80954b7f6291b870a1e2a5ac
SHA3-384 hash:	1e6ef4a5399ee04d11b8ec3136f3bf1e2e80ac5f6cc12464d1bd296a78124340147ae8e5498dc3e76fda81c7c2ca6acd
SHA1 hash:	dc9ca0d55a27eff7398459f236409c76ac3f367b
MD5 hash:	d9c4baf3f8dc8d4868e5227e728aeb76
humanhash:	muppet-montana-florida-kilo
File name:	SecuriteInfo.com.Win32.CrypterX-gen.28896.28730
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	190'976 bytes
First seen:	2023-03-15 03:28:30 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	23e8af559124378932e77f64e85571f5 (4 x Stop, 3 x RedLineStealer, 3 x Smoke Loader)
ssdeep	3072:+xrKRkkgIuMIHxJZsHBJzZ6UthRIRjk3UbP:tRkkgNO7XthP3k
Threatray	4'442 similar samples on MalwareBazaar
TLSH	T1A0146D0393A07F65E5214B729E2FC2F9761DF5708E19BB762218AA1F04B03B2E673751
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	81626e6a6a6a6a60 (1 x Stop, 1 x Smoke Loader)
Reporter	SecuriteInfoCom
Tags:	exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

220

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

smoke

ID:

File name:

SecuriteInfo.com.Win32.CrypterX-gen.28896.28730

Verdict:

Malicious activity

Analysis date:

2023-03-15 03:29:30 UTC

Tags:

loader smoke trojan

Link:

https://app.any.run/tasks/2547e817-ae31-4b20-9c5f-7c786ea055b6

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

SmokeLoader

Link:

https://www.capesandbox.com/analysis/374443/

Detection(s):

SecuriteInfo.com.Win32.CrypterX-gen.28896.28730.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Query of malicious DNS domain

Enabling autorun by creating a file

Sending an HTTP POST request to an infection source

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware lockbit mokes packed vidar

Link:

https://www.filescan.io/uploads/64113b7f3ed78da2693e0a0a/reports/1309e96c-102e-44eb-a2bf-24b48d4f80db/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/86d03866f50e32545514b56e8fc46122c136d24e80954b7f6291b870a1e2a5ac

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/6ecceebd-6426-42d0-9b1b-f467cab00e54

Result

Threat name:

Aurora, RedLine, SmokeLoader

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1193879

Signature

Antivirus detection for dropped file

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (creates a PE file in dynamic memory)

Detected unpacking (overwrites its own PE header)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Yara Aurora Stealer

Yara detected RedLine Stealer

Yara detected SmokeLoader

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/86d03866f50e32545514b56e8fc46122c136d24e80954b7f6291b870a1e2a5ac/

Threat name:

Win32.Trojan.Privateloader

Status:

Malicious

First seen:

2023-03-15 02:31:27 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=q3idqzxvbyzfiviuwvxi7rdbelatnusoqckuw73csg4hbipcuwwa._file

Verdict:

malicious

Smoke Loader

3358510dd07f7a0f84f6b8ff788bf5fb661c2259ebff3696c964f928a166a58c

Smoke Loader

47ffcfc1a0233a7bcb0b4fc36d47f20d6c1293977cf489a6c39aed02f361af2c

Smoke Loader

6fcfc6e9c3504129087f399f02026f0857e51702803c00e15c16a98d94414974

Smoke Loader

74d9950fb4a58f99306f9310d3bb295f865f164e16f2f53b6baec947ee5cfca5

Smoke Loader

ac3b9b3caa7962e5775de79c23d1f674ad4161f135af447a480ced3d3ca983a5

Smoke Loader

c45365acb54ee1edf3eda04ca895367520f3dcc86772c8561ba6eca0479fe331

Smoke Loader

e9abf1a9ce327a916ba7191b471e3039d5e50093fe7346944a83d020e89da470

Smoke Loader

fabf60ba606f708c842b3cd143642c0ec9ac49b67678742b031abfe7e5f08ef8

Smoke Loader

fec7e6d8626bf8373fbefecbdca920aa2b30ce8b94e65a78e16f042bbc9ab3e0

Smoke Loader

+ 4'432 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:redline family:smokeloader botnet:pub4 backdoor discovery infostealer spyware stealer trojan

Link:

https://tria.ge/reports/230315-d1xp2sdb7v/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Program crash

Checks installed software on the system

Executes dropped EXE

Reads user/profile data of web browsers

Downloads MZ/PE file

RedLine

RedLine payload

SmokeLoader

Malware Config

C2 Extraction:

http://vispik.at/tmp/
http://ekcentric.com/tmp/
http://hbeat.ru/tmp/
http://mordo.ru/tmp/

Unpacked files

SH256 hash:

93aa95fb6ff1197842539ad7d33661578c19614b641bc01b1339e9c74e8f6077

MD5 hash:

79e11ad9206a0e4207a1916c41d485e3

SHA1 hash:

7b2e2d5c564fe560f76bf3db8ce91acef6db1b3e

Detections:

SmokeLoaderStage2

win_smokeloader_a2

Link:

https://www.unpac.me/results/f8d84bfd-40f6-4f91-a7bf-a1df7fc4fa4a/

Parent samples :

8d817b65185a02fb3050ec898ba6dc15f88e97428402de127d0fe79e6480421d
e9abf1a9ce327a916ba7191b471e3039d5e50093fe7346944a83d020e89da470
3358510dd07f7a0f84f6b8ff788bf5fb661c2259ebff3696c964f928a166a58c
e6ac1fe76c5644ac4f6624ffd984aebf33708da63cd425e58218eac16b9500c3
b3c1c51816ed1e710c16b9979424f6e048de948320e1560664f02b7fd68a1c70
bfa7f935ce2d538f08ef9b71990ff857c855ae47f402010207533a85831b0d69
d0c09c00990cc693789f83e8dfb4d3e7db62a583d246cea22b2c6bb3a2c3e6f0
9b6da424a0f27a420231b67553454bf11d1283164fd176d688ddd43f2a6c4dfc
35c8d963860e8a3b6f74aae074eeae71dbcd50f4ac55e72f4509f15eb45e6f09
6fcfc6e9c3504129087f399f02026f0857e51702803c00e15c16a98d94414974
86d03866f50e32545514b56e8fc46122c136d24e80954b7f6291b870a1e2a5ac
e5147ae13310b2b93da17d2800a21956788671c907f7dd19a3918c0b9fcc051b
a55fb5f4931b56a67accf6b1e95d17bb96a3e12b5a960816c60dfd06bb440d9c
ba22d964e19050f18e2616497d28864c3f3e7e4f6769b6b55020002af356fd52
cd3e1831de588644e2706fa76f1b8bdd13e575cd648b6db24ddc4c9016ab978b
92a5b282a453a1d71a1d800a95018b6248da4a8cdcc58e82c56266be169cc98c
1b47e6ab6638a2d79d7a5f80627f4e96a7169b8083c6d69fb8f32ee6efcc2aa5
8566c357f42e4e6f442564c63c376540b4e4d0ee72d38f83a3de84a83931a6ce
49d393dd5011f729861bba497ebc7a0fc1312dff59820659e922bf109dd66ac3
84f201911eea13e0a46afa437f7a5942a1d70afab17edcb4fe65680d1599f602

SH256 hash:

86d03866f50e32545514b56e8fc46122c136d24e80954b7f6291b870a1e2a5ac

MD5 hash:

d9c4baf3f8dc8d4868e5227e728aeb76

SHA1 hash:

dc9ca0d55a27eff7398459f236409c76ac3f367b

Link:

https://www.unpac.me/results/f8d84bfd-40f6-4f91-a7bf-a1df7fc4fa4a/

Malware family:

SmokeLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/86d03866f50e/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/86d03866f50e32545514b56e8fc46122c136d24e80954b7f6291b870a1e2a5ac

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.