MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88cf3b02e8a2cd32120cfdb1691b7498f0672ad5de2dea2d292daa62d6e760f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 17


Intelligence 17 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88cf3b02e8a2cd32120cfdb1691b7498f0672ad5de2dea2d292daa62d6e760f2
SHA3-384 hash: 0b53c10239dbc005ad8fca40560b80de9da344bb894aff49e578d8564439b27786d94c70089ca6b77ee67c05fb39958b
SHA1 hash: e82961b5a8fca31bfa87ecd2b64eeb07ff2a7501
MD5 hash: 9fd7f319a225f352feb167864232a782
humanhash: snake-social-helium-kansas
File name:4539OWYReojsYPuGmripQyLWqSnb.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:217'600 bytes
First seen:2023-04-19 15:34:26 UTC
Last seen:2023-04-19 15:42:18 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e0d7f571370332058b298100af926d07 (2 x Tofsee, 2 x Amadey, 2 x RedLineStealer)
ssdeep 3072:+TCDHRZh5tR2ARGuIO/UVEUjobMO30H5J/OjtRyj5g4WQilhPRhdxuA6I7iMP:ssDTtRVMuICUUbhpAqTQWp/7iM
Threatray 15 similar samples on MalwareBazaar
TLSH T15524E02976A1C072C9A706B15C70DED92A7DBC124775858F37793FAA2E223D04E7231B
TrID 34.4% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
25.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
10.8% (.SCR) Windows screen saver (13097/50/3)
8.7% (.EXE) Win64 Executable (generic) (10523/12/4)
5.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon f0d48a8e162a4002 (1 x Smoke Loader)
Reporter 0xToxin
Tags:104-156-149-33 exe opendir Smoke Loader

Intelligence

File Origin
# of uploads :
2
# of downloads :
208
Origin country :
IL IL
Vendor Threat Intelligence
Malware family:
smoke
Create hunting rule
ID:
1
File name:
4539OWYReojsYPuGmripQyLWqSnb.exe
Verdict:
Malicious activity
Analysis date:
2023-04-19 15:47:42 UTC
Tags:
stealer loader smoke trojan
Link:
https://app.any.run/tasks/146d1ed6-6562-4b07-acf9-d9171fa05e7f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
SmokeLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/383337/
Detection(s):
Sanesecurity.Malware.29231.BadIN.UNOFFICIAL
Create hunting rule

Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Connecting to a non-recommended domain
Sending an HTTP POST request
Launching a process
Reading critical registry keys
Creating a file in the %temp% directory
Searching for synchronization primitives
Setting browser functions hooks
Stealing user critical data
Unauthorized injection to a system process
Enabling autorun by creating a file
Unauthorized injection to a browser process
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/80421/overview
Behaviour
MalwareBazaar
SystemUptime
CPUID_Instruction
MeasuringTime
CheckCmdLine
EvasionQueryPerformanceCounter
EvasionGetTickCount
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/64400a2b12f914d0711b60b7/reports/666d1ae0-5fc1-45b4-8b56-81bcd831969b/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/88cf3b02e8a2cd32120cfdb1691b7498f0672ad5de2dea2d292daa62d6e760f2
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/796aa4ec-fee4-4237-8c83-bd8328510ca6
Result
Threat name:
SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1217470
Signature
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 850411 Sample: 4539OWYReojsYPuGmripQyLWqSnb.exe Startdate: 20/04/2023 Architecture: WINDOWS Score: 100 49 Snort IDS alert for network traffic 2->49 51 Found malware configuration 2->51 53 Malicious sample detected (through community Yara rule) 2->53 55 5 other signatures 2->55 7 4539OWYReojsYPuGmripQyLWqSnb.exe 2->7         started        10 sfjgitd 2->10         started        process3 signatures4 57 Detected unpacking (changes PE section rights) 7->57 59 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 7->59 61 Maps a DLL or memory area into another process 7->61 63 Creates a thread in another existing process (thread injection) 7->63 12 explorer.exe 4 9 7->12 injected 65 Multi AV Scanner detection for dropped file 10->65 67 Machine Learning detection for dropped file 10->67 69 Checks if the current machine is a virtual machine (disk enumeration) 10->69 process5 dnsIp6 39 176.113.115.47, 49697, 49698, 49699 SELECTELRU Russian Federation 12->39 35 C:\Users\user\AppData\Roaming\sfjgitd, PE32 12->35 dropped 37 C:\Users\user\...\sfjgitd:Zone.Identifier, ASCII 12->37 dropped 71 Benign windows process drops PE files 12->71 73 Injects code into the Windows Explorer (explorer.exe) 12->73 75 Deletes itself after installation 12->75 77 2 other signatures 12->77 17 explorer.exe 6 12->17         started        20 explorer.exe 19 12->20         started        23 explorer.exe 12->23         started        25 11 other processes 12->25 file7 signatures8 process9 file10 41 System process connects to network (likely due to code injection or exploit) 17->41 43 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 17->43 45 Tries to steal Mail credentials (via file / registry access) 17->45 47 Tries to harvest and steal browser information (history, passwords, etc) 17->47 27 C:\Users\user\AppData\...\WalletProxy.dll, PE32 20->27 dropped 29 C:\Users\...\WalletBackgroundServiceProxy.dll, PE32 20->29 dropped 31 C:\Users\user\AppData\...\WalletProxy.dll, PE32 20->31 dropped 33 C:\Users\...\WalletBackgroundServiceProxy.dll, PE32 20->33 dropped signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/88cf3b02e8a2cd32120cfdb1691b7498f0672ad5de2dea2d292daa62d6e760f2/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2023-04-19 15:35:09 UTC
File Type:
PE (Exe)
Extracted files:
24
AV detection:
22 of 24 (91.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rdhtwaxiulgteeqm7wywsg3utdygokwv3yw6uljjfwvgfvxhmdza._file
Verdict:
malicious
Similar samples:
1af8e12dda40260493fb5552768e9eacbc49fec6d2f1e727124f3b531887c9ff
Smoke Loader
76d4a33e66fc7e913311992c08630ebe9ff843adec442e1e1c3092a5946ce389
Smoke Loader
7d5da29d2b278e323d0d2239a95e77c4923920917b114c2e06f46a85018ad33c
Smoke Loader
8c2baae0a90d6c9aac5d868d691e0f13d501d1abec409d34bcfcb2aa0dadf4ea
Smoke Loader
a9f0227256e63f635daae48473ba1d0ddb619ec296954f68a79a279695cbde3b
Smoke Loader
cb91265cb1cecf63fb73cd8565132f384f14265d3a370ffd643996aeb4a8b137
Smoke Loader
e0cdc31d38a91fece96f6e73e51f85cc96bb13515b3066957e9db020e95f9e36
Smoke Loader
e91020e4305ac22f1bede229948262c048b0bedacc08afead6ebbf0422f3e05c
Smoke Loader
edb995b82cb9d935dd6a11ea8a534066d888c197967112da531baa38471e1319
Smoke Loader
fd7e7f6f1ee80ce2ec20e391522844a00792d3a9e86f8f8a10075f0a6e032b2e
Smoke Loader
+ 5 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor collection spyware trojan
Link:
https://tria.ge/reports/230419-s1cgfabd85/
Behaviour
Checks SCSI registry key(s)
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
outlook_win_path
Accesses Microsoft Outlook profiles
Accesses cryptocurrency files/wallets, possible credential harvesting
SmokeLoader
Malware Config
C2 Extraction:
http://176.113.115.47/
https://176.113.115.47/
Unpacked files
SH256 hash:
bda9f3989ab825cd8abf4d883aef0fc6cdb89389bc13ae97995bdf43ac14014f
MD5 hash:
3df4c1f0234d5a3ad309b74e2d8d1b7f
SHA1 hash:
754114c348d33b68fe4ca3d7c06d1af5e8bae0de
Detections:
SmokeLoaderStage2
Create hunting rule
win_smokeloader_a2
Create hunting rule
Link:
https://www.unpac.me/results/d9fc76f3-29bd-40da-bd97-966c9105c4de/
Parent samples :
f8f0d72cf97e25b6dc0ff8d5ab193894cc2befd975a548d20724b28120006d43
e9536c08cffb2ce78225bb133a4c2315e6516620ec671afbcea66fcc690efd8e
88cf3b02e8a2cd32120cfdb1691b7498f0672ad5de2dea2d292daa62d6e760f2
SH256 hash:
88cf3b02e8a2cd32120cfdb1691b7498f0672ad5de2dea2d292daa62d6e760f2
MD5 hash:
9fd7f319a225f352feb167864232a782
SHA1 hash:
e82961b5a8fca31bfa87ecd2b64eeb07ff2a7501
Link:
https://www.unpac.me/results/d9fc76f3-29bd-40da-bd97-966c9105c4de/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/88cf3b02e8a2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/88cf3b02e8a2cd32120cfdb1691b7498f0672ad5de2dea2d292daa62d6e760f2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/383337/

Comments