MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 975a47f1778cdcf8055715b9351f32315ca77bb0b4c237ae473efdeec558dd7c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 975a47f1778cdcf8055715b9351f32315ca77bb0b4c237ae473efdeec558dd7c
SHA3-384 hash: dcc0f0e21b10da5b03d3fbfb173a24188463625b21e4c99abcd48a4446eb13d600340ca3546393d638c6a27620247662
SHA1 hash: 3ac04054b8875df40f7f352b0b700ec63062d371
MD5 hash: 7762f5d0fc672fac544f5bce786707b3
humanhash: one-sweet-three-green
File name:7762f5d0fc672fac544f5bce786707b3.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:210'944 bytes
First seen:2021-08-11 16:07:39 UTC
Last seen:2021-08-11 17:06:46 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash d01336643bf96b29567aa2447e71141a (4 x RaccoonStealer, 3 x Smoke Loader, 1 x AZORult)
ssdeep 3072:9LaJ1A+Fm8fMY5QRzBMVaLScsYh6gSVywo3c+:9d+UaOR6am7knGyHM
Threatray 267 similar samples on MalwareBazaar
TLSH T14324AE217EF8C572D49509304822CBE4567FEDA1B960254B3BA8BB6FFE303D1167634A
dhash icon 4839b2b0e8c38890 (105 x RaccoonStealer, 38 x Smoke Loader, 33 x RedLineStealer)
Reporter abuse_ch
Tags:Dofoil exe Smoke Loader

Intelligence

File Origin
# of uploads :
2
# of downloads :
480
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
210811-xayxkgz8t6_pw_infected.zip
Verdict:
Malicious activity
Analysis date:
2021-08-11 11:35:21 UTC
Tags:
trojan stealer raccoon loader
Link:
https://app.any.run/tasks/a7172d2e-d828-4ec6-83f1-814446a955dd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/178332/
Detection(s):
SecuriteInfo.com.Trojan.MulDrop18.23258.468.11281.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %AppData% subdirectories
Launching a process
Creating a process from a recently created file
Sending a UDP request
Enabling autorun by creating a file
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
DanaBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/37ad452f-6901-46b9-82b6-fc9c817115c9
Result
Threat name:
Clipboard Hijacker
Create hunting rule
Detection:
malicious
Classification:
spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/831120
Signature
Contains functionality to compare user and computer (likely to detect sandboxes)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Clipboard Hijacker
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/975a47f1778cdcf8055715b9351f32315ca77bb0b4c237ae473efdeec558dd7c/
Threat name:
Win32.Trojan.Zenpak
Create hunting rule
Status:
Malicious
First seen:
2021-08-11 11:29:02 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=s5nep4lxrtopqbkxcw4tkhzsgfoko65qwtbdplshh3665rky3v6a._file
Verdict:
unknown
Similar samples:
0503af61fcc1260a86771eb486d9f01df5ca37f3634d248c739322dcba03ae7b
Smoke Loader
27b6d10903852d398a72b96b736d4f9811e005bb5dc5451143584af7e0562325
Smoke Loader
29924af043739881674c7d7ac9d2d08a5021e41484a49f28ee43d253cb9e3be7
Smoke Loader
30dbf8a38ef44fcafeb10cf5339d7e124773d1c7f33e269f1100b6c4f93a134b
Smoke Loader
4db326a2737abb2f7822cebea35e82135f7577feb6ba7f0e5657afe2a0f3d0c9
Smoke Loader
5d7545aed39d6e4579ab79537c3c8c398dd60b537a22130464d1c1151befa73c
Smoke Loader
69ac14ed2f1e37e37c70d7d60bd299703931017c43f5166055a43a651882c83d
Smoke Loader
6ef0190cda06f62044e6aed620b74d3b1c588bdafd3c491ae729b0ef25dc00a5
Smoke Loader
94d5244c6d029eff0002989cb51a3ec3167217533d3eec2f38aeee74ff5c818e
Smoke Loader
a0bd573a180420b6866b638039e91f90c678f83b7a40a0b3ccca68d891dafc32
Smoke Loader
+ 257 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/210811-r2z1snx9m2/
Behaviour
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Executes dropped EXE
Unpacked files
SH256 hash:
19189d845acac54398888e27a66eb3771588bbde2080d3d3aab138053aee89e0
MD5 hash:
d850f8d4823240e54f834f85e09bd9e7
SHA1 hash:
2b7d73ebe87cf045464714074b06e756e788d05d
Link:
https://www.unpac.me/results/150a17c0-0c3a-4aad-a4b5-8b965e972171/
SH256 hash:
975a47f1778cdcf8055715b9351f32315ca77bb0b4c237ae473efdeec558dd7c
MD5 hash:
7762f5d0fc672fac544f5bce786707b3
SHA1 hash:
3ac04054b8875df40f7f352b0b700ec63062d371
Link:
https://www.unpac.me/results/150a17c0-0c3a-4aad-a4b5-8b965e972171/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/975a47f1778cdcf8055715b9351f32315ca77bb0b4c237ae473efdeec558dd7c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_SmokeLoader
Create hunting rule
Author:ditekSHen
Description:Detects SmokeLoader variants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe 975a47f1778cdcf8055715b9351f32315ca77bb0b4c237ae473efdeec558dd7c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1524258/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/178332/

Comments