MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d7953ccff3dbc3b9aad9e25f9437b71070d7e63613e193ab4be05cffd9a1f8d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8d7953ccff3dbc3b9aad9e25f9437b71070d7e63613e193ab4be05cffd9a1f8d
SHA3-384 hash: 358d1a0b4e0293de62142396fd5ec87f336f22f0639fc3ff65278c9969b4069b9ee091852d642e3a6338fb23aa26982d
SHA1 hash: cc4dd3d68792a958423c14c38684f5d2ad689004
MD5 hash: ec5f262b9ef8f3d4afecb5f4422a5716
humanhash: cup-eighteen-johnny-double
File name:SecuriteInfo.com.W32.AIDetect.malware1.4421.2415
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:202'240 bytes
First seen:2021-08-03 19:17:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 41772127f978069b9f399090f08eba15 (4 x Smoke Loader, 3 x RaccoonStealer, 1 x DanaBot)
ssdeep 6144:jh5Ngrpo05EFwymJKWLtsWQGxL9RmR5QmC3SQPRwoOL:NOo05Ewj3xCuTpwoO
Threatray 2'374 similar samples on MalwareBazaar
TLSH T1EF14AD103580CA32D16506708834F6B06B7AFC715DF7DA877BF976AE5E322D2BA25342
dhash icon 1272d292105c5c03 (31 x RaccoonStealer, 6 x Smoke Loader, 4 x Loki)
Reporter SecuriteInfoCom
Tags:exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
146
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.W32.AIDetect.malware1.4421.2415
Verdict:
Suspicious activity
Analysis date:
2021-08-03 19:19:36 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/39793f9b-398e-46fe-98c8-889f37635b3c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/176168/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.4421.2415.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file
Deleting a recently created file
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Searching for analyzing tools
Searching for the window
Connection attempt
Sending an HTTP POST request
DNS request
Sending an HTTP GET request
Launching a process
Sending a custom TCP request
Reading critical registry keys
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Query of malicious DNS domain
Connection attempt to an infection source
Sending a TCP request to an infection source
Unauthorized injection to a system process
Deleting of the original file
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Sending an HTTP GET request to an infection source
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/58ecb87b-518d-43d9-ac49-ca205a807d91
Result
Threat name:
Raccoon RedLine SmokeLoader Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/826482
Signature
Antivirus detection for URL or domain
Benign windows process drops PE files
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Contains functionality to steal Internet Explorer form passwords
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Performs DNS queries to domains with low reputation
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Removes signatures from Windows Defender
Sigma detected: Schedule system process
Sigma detected: Suspicious Svchost Process
Sigma detected: System File Execution Location Anomaly
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file access)
Uses known network protocols on non-standard ports
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Raccoon Stealer
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 458913 Sample: SecuriteInfo.com.W32.AIDete... Startdate: 03/08/2021 Architecture: WINDOWS Score: 100 66 127.0.0.1 unknown unknown 2->66 68 readinglistforjuly10.xyz 2->68 70 api.ip.sb 2->70 98 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->98 100 Antivirus detection for URL or domain 2->100 102 System process connects to network (likely due to code injection or exploit) 2->102 104 17 other signatures 2->104 10 SecuriteInfo.com.W32.AIDetect.malware1.4421.exe 2->10         started        13 cghffva 2->13         started        15 cghffva 2->15         started        signatures3 process4 signatures5 116 Detected unpacking (changes PE section rights) 10->116 17 SecuriteInfo.com.W32.AIDetect.malware1.4421.exe 10->17         started        118 Contains functionality to inject code into remote processes 13->118 20 cghffva 13->20         started        120 Injects a PE file into a foreign processes 15->120 process6 signatures7 90 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 17->90 92 Maps a DLL or memory area into another process 17->92 94 Checks if the current machine is a virtual machine (disk enumeration) 17->94 22 explorer.exe 19 17->22 injected 96 Creates a thread in another existing process (thread injection) 20->96 process8 dnsIp9 72 45.150.67.148, 80 ASDETUKhttpwwwheficedcomGB Montenegro 22->72 74 readinglistforjuly9.xyz 141.136.0.194, 49769, 80 NANO-ASLV Latvia 22->74 76 11 other IPs or domains 22->76 42 C:\Users\user\AppData\Roaming\cghffva, PE32 22->42 dropped 44 C:\Users\user\AppData\Local\Temp\777E.exe, PE32+ 22->44 dropped 46 C:\Users\user\AppData\Local\Temp\61FF.exe, PE32 22->46 dropped 48 7 other files (3 malicious) 22->48 dropped 108 System process connects to network (likely due to code injection or exploit) 22->108 110 Benign windows process drops PE files 22->110 112 Performs DNS queries to domains with low reputation 22->112 114 2 other signatures 22->114 27 5E16.exe 80 22->27         started        32 61FF.exe 22->32         started        34 44C8.exe 3 22->34         started        36 497C.exe 1 22->36         started        file10 signatures11 process12 dnsIp13 82 5.181.156.60, 49781, 80 MIVOCLOUDMD Moldova Republic of 27->82 84 telete.in 195.201.225.248, 443, 49780 HETZNER-ASDE Germany 27->84 50 C:\Users\user\AppData\LocalLow\sqlite3.dll, PE32 27->50 dropped 52 C:\Users\user\AppData\...\vcruntime140.dll, PE32 27->52 dropped 54 C:\Users\user\AppData\...\ucrtbase.dll, PE32 27->54 dropped 62 56 other files (none is malicious) 27->62 dropped 122 Detected unpacking (changes PE section rights) 27->122 124 Detected unpacking (overwrites its own PE header) 27->124 126 Tries to steal Mail credentials (via file access) 27->126 128 Contains functionality to steal Internet Explorer form passwords 27->128 86 23.88.49.119, 49783, 80 ENZUINC-US United States 32->86 88 prophefliloc.tumblr.com 74.114.154.18, 443, 49782 AUTOMATTICUS Canada 32->88 56 C:\Users\user\AppData\...\vcruntime140[1].dll, PE32 32->56 dropped 58 C:\Users\user\AppData\...\mozglue[1].dll, PE32 32->58 dropped 60 C:\Users\user\AppData\Local\...\nss3[1].dll, PE32 32->60 dropped 64 9 other files (none is malicious) 32->64 dropped 130 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 32->130 132 Tries to harvest and steal browser information (history, passwords, etc) 32->132 134 Tries to steal Crypto Currency Wallets 32->134 136 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 34->136 138 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 34->138 38 44C8.exe 15 32 34->38         started        file14 signatures15 process16 dnsIp17 78 194.233.74.11 NEXINTO-DE Germany 38->78 80 api.ip.sb 38->80 106 Tries to steal Crypto Currency Wallets 38->106 signatures18
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8d7953ccff3dbc3b9aad9e25f9437b71070d7e63613e193ab4be05cffd9a1f8d/
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2021-08-03 19:18:06 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=rv4vhth7hw6dxgvntys7sq33oedq27tdme7bsovuxyc477m2d6gq._file
Verdict:
malicious
Similar samples:
0cd327d648018f31e5a411a72c839b8b74bb188488a32ddf7289990ae516fa7d
Smoke Loader
0fe70947f77741fac09da7aa80e82896d92bc08450b4fc029c04c5e803bf3259
Smoke Loader
16bf40060a0544cf49bda85272b976265fb56248c6068d7d95296937af664ecc
Smoke Loader
1a1d8823b35b8c0d8dfcebe065520a07fe105589893262976fce4122317c55b8
Smoke Loader
6ef31a13d71d059d6e007fb2305c8e2d7615c3d468c9f2f4e023b45490b50787
Smoke Loader
7a271f6c34a12ada4d25503316bfdd9f8806acc6619af04427f509f173d49132
Smoke Loader
9eafc2a0a992162261c3da6ae7206ed2d1466d3280149469ff323402a7dc09f9
Smoke Loader
9f900d8fa07652fef51b583c5422ce011ce0940c59de8487d90ee0cabaeba530
Smoke Loader
be08ab1ce25fee08933f9538121460516ae66f5cd881dd06613c0d7c8882e7e0
Smoke Loader
e6b35d9156c1b830d000926b8dd12fe13185fa2e910692969215bf707686b595
Smoke Loader
+ 2'364 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:raccoon family:redline family:smokeloader family:vidar family:xmrig botnet:408 botnet:cd8dc1031358b1aec55cc6bc447df1018b068607 backdoor discovery evasion infostealer miner spyware stealer suricata themida trojan
Link:
https://tria.ge/reports/210803-xy3j3s6pqs/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Creates scheduled task(s)
Delays execution with timeout.exe
Kills process with taskkill
Modifies registry class
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
Checks BIOS information in registry
Deletes itself
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Themida packer
Downloads MZ/PE file
Executes dropped EXE
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Vidar Stealer
Raccoon
Raccoon Stealer Payload
RedLine
SmokeLoader
Vidar
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
xmrig
Malware Config
C2 Extraction:
http://readinglistforjuly1.xyz/
http://readinglistforjuly2.xyz/
http://readinglistforjuly3.xyz/
http://readinglistforjuly4.xyz/
http://readinglistforjuly5.xyz/
http://readinglistforjuly6.xyz/
http://readinglistforjuly7.xyz/
http://readinglistforjuly8.xyz/
http://readinglistforjuly9.xyz/
http://readinglistforjuly10.xyz/
http://readinglistforjuly1.site/
http://readinglistforjuly2.site/
http://readinglistforjuly3.site/
http://readinglistforjuly4.site/
http://readinglistforjuly5.site/
http://readinglistforjuly6.site/
http://readinglistforjuly7.site/
http://readinglistforjuly8.site/
http://readinglistforjuly9.site/
http://readinglistforjuly10.site/
http://readinglistforjuly1.club/
http://readinglistforjuly2.club/
http://readinglistforjuly3.club/
http://readinglistforjuly4.club/
http://readinglistforjuly5.club/
http://readinglistforjuly6.club/
http://readinglistforjuly7.club/
http://readinglistforjuly8.club/
http://readinglistforjuly9.club/
http://readinglistforjuly10.club/
https://prophefliloc.tumblr.com/
Unpacked files
SH256 hash:
567660462bf0b6efcb3355ec6a5806a8e68990f423cda4afb601dfd270d5ff54
MD5 hash:
9740d3ad5f3001f0ace007137fb42cfe
SHA1 hash:
94b48d76bfccc7cfe79ba8f3ed16409ee538b811
Link:
https://www.unpac.me/results/93b80880-5e94-4eb0-b5cc-c2dd180f3aeb/
SH256 hash:
8d7953ccff3dbc3b9aad9e25f9437b71070d7e63613e193ab4be05cffd9a1f8d
MD5 hash:
ec5f262b9ef8f3d4afecb5f4422a5716
SHA1 hash:
cc4dd3d68792a958423c14c38684f5d2ad689004
Link:
https://www.unpac.me/results/93b80880-5e94-4eb0-b5cc-c2dd180f3aeb/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8d7953ccff3dbc3b9aad9e25f9437b71070d7e63613e193ab4be05cffd9a1f8d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 8d7953ccff3dbc3b9aad9e25f9437b71070d7e63613e193ab4be05cffd9a1f8d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1502766/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/176168/

Comments