MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a9f3452db181e6a402c1c2b5f4848c657535bf94572a12eee70a57721f9931b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 8

Intelligence 8 IOCs YARA File information Comments

SHA256 hash:	8a9f3452db181e6a402c1c2b5f4848c657535bf94572a12eee70a57721f9931b
SHA3-384 hash:	38d37ca9112110b20c82bed9ceac1b17c7428146e009f3c0f74fc502983c127d37726b848a2c7794ed5852347d1be5f6
SHA1 hash:	984eac7eada895b48756f465b426f1483868bb0a
MD5 hash:	82e46332f262e9ddb95002bd7cf544ea
humanhash:	shade-seven-california-burger
File name:	82e46332f262e9ddb95002bd7cf544ea.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	150'016 bytes
First seen:	2021-08-20 15:03:34 UTC
Last seen:	2021-08-20 16:12:31 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	a84fa8c5c9d81b30cf439f0d2b7f422b (7 x RedLineStealer, 4 x RaccoonStealer, 2 x Smoke Loader)
ssdeep	1536:eEw4XUR0oWjdDvxW1tW7vdO4sy/QNR1ID0SpBZ6hxFOT7U65FzABFnLFBMK48o:eiFvEbWj2YQNR1ID73CFMT5FzgFnLmx
Threatray	3'654 similar samples on MalwareBazaar
TLSH	T163E3BE2275F1CD73D096593D0825CA905A7DFD712EB08A433E9B236E1E712C19A3BF92
dhash icon	1072c093b0381902 (22 x RedLineStealer, 7 x RaccoonStealer, 4 x Smoke Loader)
Reporter	abuse_ch
Tags:	exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

134

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

82e46332f262e9ddb95002bd7cf544ea.exe

Verdict:

No threats detected

Analysis date:

2021-08-20 15:09:24 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/16dd042f-4e15-46bf-bbb0-41f956c30134

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/180980/

Detection(s):

SecuriteInfo.com.Variant.Fragtor.9685.8579.11503.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending a UDP request

Creating a window

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Connection attempt

Sending an HTTP POST request

Deleting of the original file

Enabling autorun by creating a file

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

DanaBot

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/1ecadd01-c1a9-4ea5-919f-eb25ad81b967

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/836521

Signature

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8a9f3452db181e6a402c1c2b5f4848c657535bf94572a12eee70a57721f9931b/

Threat name:

Win32.Trojan.Wacatac

Status:

Malicious

First seen:

2021-08-20 15:04:05 UTC

AV detection:

25 of 46 (54.35%)

Threat level:

5/5

Verdict:

suspicious

Smoke Loader

5f8cc8891a363948a514f7d91aa9170a3c9b743b29dbffbe87108c66dd66ff69

Smoke Loader

786011dec9484fb81863be557b51a2adba291cee4cc6c6f91fd21c2ce94cb1a8

Smoke Loader

8eea00bd7d1db820c7a1b5622119b76944215e5803c2e8b772b9548e9ee91c66

Smoke Loader

959ed9b65f2c1dff0e7f16367b4f8b04dc091350219a80b63d58e50799e58ce3

Smoke Loader

95d9e11ec01f83253ab4bd861de609f52b101c160214612d5ffa615f3c931a7c

Smoke Loader

9d1574036b8d1853c6355e6212c29ffe57e1e0653b65605b0f9664e5d194b2f9

Smoke Loader

d775f62d097e069293b27267d7efd95862e55e7ecc5e23e9c3ea532c39321b0e

Smoke Loader

dbb1ffb8a8b13b389fd8aff976808226333bc23d8aafc33111b88206f498fcea

Smoke Loader

dfae191d0f324a74e03fe2b99f10a2a33daca3ede5b2f226db8d4905d76414ef

Smoke Loader

+ 3'644 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor discovery persistence trojan

Link:

https://tria.ge/reports/210820-nes3dzlwzj/

Behaviour

Checks SCSI registry key(s)

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Adds Run key to start application

Looks up external IP address via web service

Deletes itself

Loads dropped DLL

Modifies file permissions

Downloads MZ/PE file

Executes dropped EXE

SmokeLoader

Malware Config

C2 Extraction:

http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/