MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 998d503aa5e68830d7f981490108d44dc12f331bd5ad9ea9f207a99e6d06afbb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 12

Intelligence 12 IOCs YARA File information Comments

SHA256 hash:	998d503aa5e68830d7f981490108d44dc12f331bd5ad9ea9f207a99e6d06afbb
SHA3-384 hash:	19fa529f333adb627eaab01dc02d8619d9f721990f6aad5e3d52a69ba2e5d0d44b8a27a1e04206641c6d8916f48199ed
SHA1 hash:	8642ff9423255714c753e8126f3eefc5f92f01b9
MD5 hash:	6e69a6b673cbe7b72ff6e3684adc74eb
humanhash:	maryland-lamp-michigan-rugby
File name:	6e69a6b673cbe7b72ff6e3684adc74eb.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	236'032 bytes
First seen:	2022-03-27 17:09:40 UTC
Last seen:	2022-03-27 17:45:00 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	a945bbba5e19a9f29aa1458bdc91ed8a (6 x Smoke Loader, 6 x SystemBC, 5 x Worm.Ramnit)
ssdeep	3072:e//RakHeb+Jfk774EI2UdMStWld84F5bO3Fb8Ag:U5ax+KP4EI2UdMKWldTjO3Fb8
Threatray	15'802 similar samples on MalwareBazaar
TLSH	T14334D03236D1C072C8975531B864CAB15FAE9432B3A2588B379D277E6F303D157BA34A
File icon (PE):
dhash icon	5c59da3ce0c1c850 (36 x Stop, 33 x Smoke Loader, 26 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

209

Origin country :

n/a

Vendor Threat Intelligence

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/258190/

Detection(s):

SecuriteInfo.com.Trojan.DownLoader44.47781.25471.21160.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Sending an HTTP POST request

Sending a custom TCP request

Sending an HTTP GET request

Enabling autorun by creating a file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/11602/overview

Behaviour

SystemUptime

MeasuringTime

EvasionGetTickCount

CheckCmdLine

EvasionQueryPerformanceCounter

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

anti-vm greyware

Link:

https://www.filescan.io/uploads/62409a6f9253b276b785e502/reports/45a67604-22ec-41a4-9381-c6dc1b9292fc/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

STOP Ransomware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8adeac7d-54cf-45a9-ba5f-ceb841a73b03

Result

Threat name:

RedLine SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/965327

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code references suspicious native API functions

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Hides threads from debuggers

Machine Learning detection for dropped file

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to evade debugger and weak emulator (self modifying code)

Yara detected RedLine Stealer

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/998d503aa5e68830d7f981490108d44dc12f331bd5ad9ea9f207a99e6d06afbb/

Threat name:

Win32.Trojan.Raccrypt

Status:

Malicious

First seen:

2022-03-27 12:47:18 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 26 (80.77%)

Threat level:

5/5

Verdict:

malicious

Smoke Loader

54e3ee54fac434e25c03ded56a4680f1ea40a245d657440ac9c51be7f27ef656

Smoke Loader

5aecb2a5bc5447dc736c29882193fef4f2b007299a1817c664e1ba6a028363cf

Smoke Loader

a37cbddb545f168aa1dbb09433e228e5a956f6d8fbc00fae892a5f047990a71f

Smoke Loader

a63b9c4ed6d83aff1bf47215f3297d5fb1cd85e69a24deac6750d511f61de055

Smoke Loader

af94ec40248120d040629b0b921538db88886fb9534a7a167d06d2b6ef5da784

Smoke Loader

+ 15'792 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor trojan

Link:

https://tria.ge/reports/220327-vppczaaff6/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Program crash

Deletes itself

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

SmokeLoader

Malware Config

C2 Extraction:

http://coralee.at/upload/
http://ducvietcao.com/upload/
http://biz-acc.ru/upload/
http://toimap.com/upload/
http://bbb7d.com/upload/
http://piratia-life.ru/upload/
http://curvreport.com/upload/
http://viagratos.com/upload/
http://mordo.ru/upload/
http://pkodev.net/upload/