MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96f8a3c0483dcd2723fcee7cd9ef8b6816661e29825c2d052657e83473da0653. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 96f8a3c0483dcd2723fcee7cd9ef8b6816661e29825c2d052657e83473da0653
SHA3-384 hash: bbab4f974a183c0b44c09491f4e9d919589f742c4db726911ad9605410b8422eb9cfe144c768161350faedeceecbf5ac
SHA1 hash: 85aa4861c462873d556219127d9e2e3a4df57483
MD5 hash: a3602bdb76b1ba704ae18529eabb2a8a
humanhash: montana-neptune-pluto-fruit
File name:a3602bdb76b1ba704ae18529eabb2a8a.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:138'752 bytes
First seen:2021-08-29 15:12:24 UTC
Last seen:2021-08-29 16:00:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 648d80ab383d01ef3dcdfdac14d78fcd (9 x RaccoonStealer, 2 x RedLineStealer, 1 x Smoke Loader)
ssdeep 3072:YIBtHFtm1MxpJcGeo9bIhelsTCdsI5/DuT61m:YIBtHFAMJ4glvsI5/
Threatray 1'480 similar samples on MalwareBazaar
TLSH T12DD3CF0035B0C8F3E1D359718C59A6A2677FB8326F75898B3768479F3E226D0962D393
dhash icon 4839b2b0e8c38890 (105 x RaccoonStealer, 38 x Smoke Loader, 33 x RedLineStealer)
Reporter abuse_ch
Tags:Dofoil exe Smoke Loader

Intelligence

File Origin
# of uploads :
2
# of downloads :
1'023
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
a3602bdb76b1ba704ae18529eabb2a8a.exe
Verdict:
No threats detected
Analysis date:
2021-08-29 15:13:57 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/918473c8-2c73-4a9d-b6c5-2a60a42269cd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/183274/
Detection(s):
SecuriteInfo.com.Variant.Fragtor.12980.15171.22598.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Creating a process from a recently created file
Connection attempt
Sending an HTTP POST request
Deleting of the original file
Enabling autorun by creating a file
Unauthorized injection to a system process
Malware family:
DarkComet
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9fb76ecd-5f50-433c-829a-2dfc5d03b776
Result
Threat name:
Amadey RedLine SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/841079
Signature
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to infect the boot sector
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected Amadey bot
Yara detected RedLine Stealer
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 473510 Sample: anRTZf4YyC.exe Startdate: 29/08/2021 Architecture: WINDOWS Score: 100 46 api.ip.sb 2->46 66 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->66 68 Multi AV Scanner detection for domain / URL 2->68 70 Found malware configuration 2->70 72 9 other signatures 2->72 9 anRTZf4YyC.exe 2->9         started        12 brfigbj 2->12         started        signatures3 process4 signatures5 84 Detected unpacking (changes PE section rights) 9->84 86 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 9->86 88 Maps a DLL or memory area into another process 9->88 90 Creates a thread in another existing process (thread injection) 9->90 14 explorer.exe 6 9->14 injected 92 Multi AV Scanner detection for dropped file 12->92 94 Machine Learning detection for dropped file 12->94 96 Checks if the current machine is a virtual machine (disk enumeration) 12->96 process6 dnsIp7 52 atvcampingtrips.com 211.53.202.252, 49712, 49713, 49715 LGDACOMLGDACOMCorporationKR Korea Republic of 14->52 54 193.142.59.152, 49724, 49756, 49762 HOSTSLICK-GERMANYNL Netherlands 14->54 56 4 other IPs or domains 14->56 38 C:\Users\user\AppData\Roaming\brfigbj, PE32 14->38 dropped 40 C:\Users\user\AppData\Local\Temp\6123.exe, PE32 14->40 dropped 42 C:\Users\user\AppData\Local\Temp\30FA.exe, PE32 14->42 dropped 44 C:\Users\user\...\brfigbj:Zone.Identifier, ASCII 14->44 dropped 58 System process connects to network (likely due to code injection or exploit) 14->58 60 Benign windows process drops PE files 14->60 62 Deletes itself after installation 14->62 64 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->64 19 30FA.exe 15 26 14->19         started        23 6123.exe 14->23         started        25 EEEE.exe 4 14->25         started        28 D3B4.exe 3 14->28         started        file8 signatures9 process10 dnsIp11 48 185.215.113.29, 49739, 8678 WHOLESALECONNECTIONSNL Portugal 19->48 50 api.ip.sb 19->50 74 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 19->74 76 Machine Learning detection for dropped file 19->76 78 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 19->78 82 2 other signatures 19->82 30 conhost.exe 19->30         started        80 Contains functionality to infect the boot sector 23->80 36 C:\Users\user\AppData\Local\...\hnbux.exe, PE32 25->36 dropped 32 WerFault.exe 20 9 25->32         started        34 conhost.exe 28->34         started        file12 signatures13 process14
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/96f8a3c0483dcd2723fcee7cd9ef8b6816661e29825c2d052657e83473da0653/
Threat name:
Win32.Trojan.Fragtor
Create hunting rule
Status:
Malicious
First seen:
2021-08-29 12:33:17 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=s34khqcihxgsoi745z6nt34lnalgmhrjqjoc2bjgk7udi462azjq._file
Verdict:
suspicious
Similar samples:
06d2ef3f80066d655c788069de3098105f6128e388e43baf73e2d9bf69365ce3
Smoke Loader
1d76266267ca27570b9cfb6f2a84b80ef607e9450d475eabad2e630cfbd77b7e
Smoke Loader
328e682510e9c0e0c37a7c8d347ecb4e7791a03b44962675a3f5f23d85250e08
Smoke Loader
34fe9331ea2b5f3ec39ee18ada691b5d0a908a95c640253bd31b7a3a023d1a5f
Smoke Loader
39326cdd0c863e1766ecc3d119ec18fdaa93ef886cfbc887f76784f745df73e4
Smoke Loader
41ce43aa875bf977ec9eb039e5853ade1af522dd0dff4f19282f6c8038ae2dff
Smoke Loader
5f0caccb3ca599a30b5f298f9bb414fe721121c83b7bedc7c59ffe4128c96b61
Smoke Loader
c7839db336f11c965ab8e6fbad1a6c757711a24362cc20d63d4ce37aef9b83b1
Smoke Loader
cf8a60b5e39660a02d37d4d5f1d28e392427c1da05142d4a651cd1c267d07cc1
Smoke Loader
+ 1'470 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:redline family:smokeloader family:vidar backdoor discovery infostealer persistence stealer trojan
Link:
https://tria.ge/reports/210829-wsy9fek1px/
Behaviour
Checks SCSI registry key(s)
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Looks up external IP address via web service
Deletes itself
Loads dropped DLL
Modifies file permissions
Downloads MZ/PE file
Executes dropped EXE
Vidar Stealer
RedLine
RedLine Payload
SmokeLoader
Vidar
Malware Config
C2 Extraction:
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
185.215.113.29:8678
Unpacked files
SH256 hash:
18cd8e90fcd46329480f24d43baa489683b3ee2fcd274bf1714947ef307a6ab2
MD5 hash:
f2fecf6872ad4c61a3a506159fddd4fc
SHA1 hash:
28e039eb96dcf58841992280c66433a2bbab8e84
Link:
https://www.unpac.me/results/4df419a5-494f-425a-85b3-1bec5690c47d/
SH256 hash:
96f8a3c0483dcd2723fcee7cd9ef8b6816661e29825c2d052657e83473da0653
MD5 hash:
a3602bdb76b1ba704ae18529eabb2a8a
SHA1 hash:
85aa4861c462873d556219127d9e2e3a4df57483
Link:
https://www.unpac.me/results/4df419a5-494f-425a-85b3-1bec5690c47d/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/96f8a3c0483d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/96f8a3c0483dcd2723fcee7cd9ef8b6816661e29825c2d052657e83473da0653

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 96f8a3c0483dcd2723fcee7cd9ef8b6816661e29825c2d052657e83473da0653

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1559349/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/183274/

Comments