MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9787649517e0a77e6e95a1a8904af132941d72ae4402f748cf3f44b8e0896e37. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9787649517e0a77e6e95a1a8904af132941d72ae4402f748cf3f44b8e0896e37
SHA3-384 hash: 910bdf99d11b2319e2d954f05550327c71960db87a17a1a3587bfc4778cac9c9c9501c3dc7a301202e72c3dc88b3fe44
SHA1 hash: a4a9aab1883ab21657efcdc43e001130f9da877b
MD5 hash: 24415294427a8610b91673a1d2983c8d
humanhash: south-venus-paris-eighteen
File name:24415294427a8610b91673a1d2983c8d.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:1'030'656 bytes
First seen:2022-06-05 08:14:06 UTC
Last seen:2022-06-05 08:41:39 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash bac4984e59cf445a56fd65eee29a6243 (1 x Smoke Loader)
ssdeep 24576:wv+na9ODd9xBFW2bOfnOFhbMaPdDcJblWvNf:O+Mm9XFW2bpB0l
TLSH T19725BF36A2B08B36E27F17398CBA56BC49357D60293798893BFD0CCC5E35741296A353
TrID 65.6% (.EXE) Win32 Executable Borland Delphi 7 (664796/42/58)
25.9% (.EXE) Win32 Executable Borland Delphi 6 (262638/61)
4.2% (.EXE) InstallShield setup (43053/19/16)
1.3% (.EXE) Win32 Executable Delphi generic (14182/79/4)
1.2% (.SCR) Windows screen saver (13101/52/3)
File icon (PE):PE icon
dhash icon 399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner)
Reporter abuse_ch
Tags:Dofoil exe Smoke Loader

Intelligence

File Origin
# of uploads :
2
# of downloads :
505
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
24415294427a8610b91673a1d2983c8d.exe
Verdict:
Suspicious activity
Analysis date:
2022-06-05 08:21:47 UTC
Tags:
installer
Link:
https://app.any.run/tasks/648a5cfd-acf6-445c-a3bf-d9083bdc3597

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/276761/
Detection(s):
SecuriteInfo.com.Trojan.MulDrop20.8333.8364.1400.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
apt control.exe greyware keylogger ursnif wacatac
Link:
https://www.filescan.io/uploads/629c661ce6995f35700ec5de/reports/026de07c-6939-4256-afaf-89c18b320c27/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/23846076-3674-498e-a0c2-454914b98f9a
Result
Threat name:
CryptOne, SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
bank.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1006832
Signature
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if browser processes are running
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to compare user and computer (likely to detect sandboxes)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected CryptOne packer
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 639328 Sample: 2WFjgVkxAu.exe Startdate: 05/06/2022 Architecture: WINDOWS Score: 100 35 Multi AV Scanner detection for domain / URL 2->35 37 Found malware configuration 2->37 39 Antivirus detection for URL or domain 2->39 41 7 other signatures 2->41 7 2WFjgVkxAu.exe 2->7         started        10 gjiduud 2->10         started        process3 signatures4 51 Detected unpacking (changes PE section rights) 7->51 53 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 7->53 55 Maps a DLL or memory area into another process 7->55 57 Creates a thread in another existing process (thread injection) 7->57 12 explorer.exe 3 7->12 injected 59 Multi AV Scanner detection for dropped file 10->59 61 Machine Learning detection for dropped file 10->61 63 Checks if the current machine is a virtual machine (disk enumeration) 10->63 process5 dnsIp6 33 mariton.ws 34.66.99.9, 443, 49786, 49795 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 12->33 27 C:\Users\user\AppData\Roaming\gjiduud, PE32 12->27 dropped 29 C:\Users\user\...\gjiduud:Zone.Identifier, ASCII 12->29 dropped 65 Benign windows process drops PE files 12->65 67 Injects code into the Windows Explorer (explorer.exe) 12->67 69 Deletes itself after installation 12->69 71 2 other signatures 12->71 17 explorer.exe 6 12->17         started        21 explorer.exe 12->21         started        23 explorer.exe 12->23         started        25 5 other processes 12->25 file7 signatures8 process9 dnsIp10 31 mariton.ws 17->31 43 System process connects to network (likely due to code injection or exploit) 17->43 45 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 17->45 47 Tries to steal Mail credentials (via file / registry access) 17->47 49 3 other signatures 17->49 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9787649517e0a77e6e95a1a8904af132941d72ae4402f748cf3f44b8e0896e37/
Threat name:
Win32.Trojan.SmokeLoader
Create hunting rule
Status:
Malicious
First seen:
2022-06-02 20:35:33 UTC
File Type:
PE (Exe)
Extracted files:
92
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=s6dwjfix4ctx43uvugujasxrgkkb24voiqbposgph5clryejny3q._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  6/10
Tags:
collection
Link:
https://tria.ge/reports/220605-j5kh6sddgj/
Behaviour
Checks SCSI registry key(s)
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Accesses Microsoft Outlook profiles
Unpacked files
SH256 hash:
9787649517e0a77e6e95a1a8904af132941d72ae4402f748cf3f44b8e0896e37
MD5 hash:
24415294427a8610b91673a1d2983c8d
SHA1 hash:
a4a9aab1883ab21657efcdc43e001130f9da877b
Link:
https://www.unpac.me/results/8c5b8852-d6ea-4c42-aad6-555ad263ad90/
Malware family:
CryptOne
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9787649517e0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/9787649517e0a77e6e95a1a8904af132941d72ae4402f748cf3f44b8e0896e37

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT_DustSquad_PE_Nov19_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detection Rule for APT DustSquad campaign Nov19
Reference:https://twitter.com/Rmy_Reserve/status/1197448735422238721
Rule name:APT_DustSquad_PE_Nov19_2
Create hunting rule
Author:Arkbird_SOLG
Description:Detection Rule for APT DustSquad campaign Nov19
Reference:https://twitter.com/Rmy_Reserve/status/1197448735422238721

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/276761/

Comments