MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98368ebea0db4a1ef1ef8ae8b9cdc862c8dc5bb00bfb570f83a50794ce6ad816. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 15

Intelligence 15 IOCs YARA 6 File information Comments 1

SHA256 hash:	98368ebea0db4a1ef1ef8ae8b9cdc862c8dc5bb00bfb570f83a50794ce6ad816
SHA3-384 hash:	3225e1fc073a568ce605e36758014f1bf0fc15010d9d2addf72022c72dac1af7f82a5ebfc803810557cffa9017f2537b
SHA1 hash:	dbd2d7eb80669f1bc116b1308fdd014d1cefc1e9
MD5 hash:	24cc6b095d5f0b4d3f231e00145b4860
humanhash:	pluto-ohio-grey-three
File name:	24cc6b095d5f0b4d3f231e00145b4860
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	215'040 bytes
First seen:	2023-11-11 06:52:15 UTC
Last seen:	2023-11-11 08:24:31 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	13937693d95394f2ce32af6042a00c30 (4 x Smoke Loader)
ssdeep	3072:ZGYe0UBjwo7k8omgYyMgWPggq6W9Om5G5TNPMb6BLwhrBjFKT:ol0uXAdmgFyoR6W9OmA3C6Kx
Threatray	396 similar samples on MalwareBazaar
TLSH	T185248D1236E2A473F63346358E35C6A4DA5BFC614F646ADB1744EE3F0A712E2C672306
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	0020406064405c02 (1 x Smoke Loader)
Reporter	zbetcheckin
Tags:	32 exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

382

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

24cc6b095d5f0b4d3f231e00145b4860

Verdict:

Malicious activity

Analysis date:

2023-11-11 06:54:00 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/0bdc294a-dd93-47ea-af08-9c83b39b1c93

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win32.TrojanX-gen.16519.8566.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Sending a custom TCP request

Сreating synchronization primitives

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Sending an HTTP POST request

Sending an HTTP GET request

Query of malicious DNS domain

Sending a TCP request to an infection source

Unauthorized injection to a system process

Enabling autorun by creating a file

Sending an HTTP POST request to an infection source

Gathering data

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

control greyware lolbin packed shell32

Link:

https://www.filescan.io/uploads/654f24d06f0bce33263789d9/reports/40a5283a-3bae-4dc0-93e7-dc54135cd956/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/98368ebea0db4a1ef1ef8ae8b9cdc862c8dc5bb00bfb570f83a50794ce6ad816

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/c40b4cc8-4595-4739-9d2e-f64223624ab1

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1341006

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found API chain indicative of debugger detection

Found evasive API chain (may stop execution after checking system information)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/98368ebea0db4a1ef1ef8ae8b9cdc862c8dc5bb00bfb570f83a50794ce6ad816

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/98368ebea0db4a1ef1ef8ae8b9cdc862c8dc5bb00bfb570f83a50794ce6ad816/

Threat name:

Win32.Trojan.Generic

Status:

Malicious

First seen:

2023-11-11 06:53:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

14 of 38 (36.84%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ta3i5pva3nfb54pprlulttoimlenyw5qbp5vod4duudzjttk3ala._file

Verdict:

malicious

Smoke Loader

0ef76ecabac1c81d4e2ed32c6fd30d846214f385a51523b4b78f105d9eb406a3

Smoke Loader

247eb6cc11d0a92ac985fb99c19dcfe4779878f4989764b8ced06727820ff57c

Smoke Loader

3b73c4da6f2bda6ebc26552afccbfd8c097a5a3195fd2593840d9ea7712b7120

Smoke Loader

5c88a340b3b0502c9777fe6159f01d66875341dc739e23a56a21ee18479890f2

Smoke Loader

6a302e65ae3cd7ceb6a94b2753f1a3223b189355eecbe443b0fd45722a495f48

Smoke Loader

a73ee8f46c7caf4da7ea6a92dc0a11d58757a83e1b5b9c3723b49690fc238271

Smoke Loader

e629fcf41de2187cafd4c8c38b1e9408a5c521d29459971bb96fae5da26fa9d5

Smoke Loader

ecacf78ad957224fcc0afbd65118f2b5e8e2eda5daef0e072eef35e5f12a43b3

Smoke Loader

+ 386 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader botnet:pub1 backdoor trojan

Link:

https://tria.ge/reports/231111-hnmfrsdd94/

Behaviour

Checks SCSI registry key(s)

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of UnmapMainImage

Uses Task Scheduler COM API

Deletes itself

SmokeLoader

Malware Config

C2 Extraction:

http://dpav.cc/tmp/
http://lrproduct.ru/tmp/
http://kggcp.com/tmp/
http://talesofpirates.net/tmp/
http://pirateking.online/tmp/
http://piratia.pw/tmp/
http://go-piratia.ru/tmp/

Unpacked files

SH256 hash:

dfce14ca9fa6c76df25ff3d3ff18ba943031d07a5cae3f0bad422e2b5e7eb559

MD5 hash:

37875cacee117b15e05b3f1c808592ac

SHA1 hash:

6a7882ca410e781262af685cf395bd2458c35a3b

Detections:

SmokeLoaderStage2

win_smokeloader_a2

Link:

https://www.unpac.me/results/e12088c2-ad60-4013-bad1-2b7fb24474b7/

Parent samples :

b3c7f502503d3102ecfa6f2145573ab851947dd3f2bdfd42fefab38947837dcd
07850ea1732b07aae1b520bc4e07f939a29ea8f842993a5849965d71aec14cb1
8ce95aee92cffc56420902fa657bc82a44574450ada63eb864d11e404a59a078
73639e5216b7fb5c0550f69d63bcbb3e568fd912f9288216795eb965b1b2b6fe
5b8c310ded14940d6d98ba9d1aa5ac67b3c31f2fe5c43bd27ae99ee8cab115f1
fc447974118abe161835c31fd3b0305a84b9ba374f47a4295b435a85cc756f57
98368ebea0db4a1ef1ef8ae8b9cdc862c8dc5bb00bfb570f83a50794ce6ad816
90575d53104fa810c6896f874e421e905c3687ff1767574842d10cc143237762
e669dd52d97cc96b42efb1661dfeb898b6277a0484d25b8e86b492acf41c8f7d
1729faf82ded430ab520c6ebd82743abb231222a867329f5b15c2d01b7578016
f8619a870e7c7ef001512d9b2d5caf3b40a4855c5c72ec9a8fe7d4ee44a93b3a
1b8943b2ccea3ee9e464b5865711db721bae33ca0364630dfa6f75eb7f2c8a47

SH256 hash:

98368ebea0db4a1ef1ef8ae8b9cdc862c8dc5bb00bfb570f83a50794ce6ad816

MD5 hash:

24cc6b095d5f0b4d3f231e00145b4860

SHA1 hash:

dbd2d7eb80669f1bc116b1308fdd014d1cefc1e9

Link:

https://www.unpac.me/results/e12088c2-ad60-4013-bad1-2b7fb24474b7/

Malware family:

SmokeLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/98368ebea0db/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/98368ebea0db4a1ef1ef8ae8b9cdc862c8dc5bb00bfb570f83a50794ce6ad816

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Windows_Trojan_Smokeloader_3687686f Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

exe 98368ebea0db4a1ef1ef8ae8b9cdc862c8dc5bb00bfb570f83a50794ce6ad816

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2712491/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-11-11 06:52:16 UTC

url : hxxps://alayyadcare.com/tmp/index.php