MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a14393876e7e74393e0bd59e4d9edc10425787466cd9ade272e4a25ee17cdac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 11

Intelligence 11 IOCs YARA File information Comments

SHA256 hash:	9a14393876e7e74393e0bd59e4d9edc10425787466cd9ade272e4a25ee17cdac
SHA3-384 hash:	869137f0fff4924bc3671d0b2bbe8cc1c412212e64e966b6a4a7a8efb27cbd733a05505b0d37bd3217ae73ede71a3d8a
SHA1 hash:	d386b31249afd4cc2c1c2f1b48e5bdd9ae48a470
MD5 hash:	74adb34d55ab4742f2c1961c80486de1
humanhash:	robert-massachusetts-seven-zebra
File name:	74adb34d55ab4742f2c1961c80486de1.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	217'600 bytes
First seen:	2022-04-20 09:31:49 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	c6e11cdeac4fe163051ba996818a46c7 (1 x ArkeiStealer, 1 x Stop, 1 x AZORult)
ssdeep	3072:haIEBZ4Uh4dqIb127RXGiBni2YqT0XOdoobymGr:4nZ4Uh4M0WnBi2BT0XOKob
Threatray	16'459 similar samples on MalwareBazaar
TLSH	T14124AE22F6A0C07ED1A35930B8B9C6F11A7EF8336671948B3754E67A5F302C14AB5367
TrID	48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 16.4% (.EXE) Win64 Executable (generic) (10523/12/4) 10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	480c3c4c4f594b14 (22 x Smoke Loader, 16 x RedLineStealer, 10 x Tofsee)
Reporter	abuse_ch
Tags:	Dofoil exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

444

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/264940/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for synchronization primitives

Sending a custom TCP request

Сreating synchronization primitives

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Sending an HTTP POST request

Unauthorized injection to a system process

Enabling autorun by creating a file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware

Link:

https://www.filescan.io/uploads/625fd316ffe27d511915f5dd/reports/f0467d02-1b19-40f0-8c36-75c624ac97cc/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

AZORult

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/51b409b8-0105-4cd1-a3ce-89bc14ec0dc4

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/979443

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9a14393876e7e74393e0bd59e4d9edc10425787466cd9ade272e4a25ee17cdac/

Threat name:

Win32.Trojan.Raccrypt

Status:

Malicious

First seen:

2022-04-19 22:41:15 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

30 of 41 (73.17%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=tikdsodw47tuhe7axvm6jwpnyecck6dum3gzvxrhfzfcl3qxzwwa._file

Verdict:

malicious

Smoke Loader

0d8e031c65e57c9924aa28bb61871e136c52cc522e8b247d504808ae93d779a4

Smoke Loader

2ba0f24b947a266b0cc27837455123e7321619f2bbe7f18c1affad896e86f445

Smoke Loader

4ff32cd7d9a37a73d8c836a7c5a32792281e46b3f2d8a17fd535a4c90fe65680

Smoke Loader

7913fabae6d02e80acf5bd476fd5fe3f6d3077001780c75c40596ea657b4067a

Smoke Loader

97c090248e9c4bff5f867844b21d5637b176eabc32d6ef6013b5dd23e76d8081

Smoke Loader

edc39f88a7ef54af6e85f67335c07e6c782a4c0b63b37babff3dc4aa014eb7ac

Smoke Loader

+ 16'449 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor trojan

Link:

https://tria.ge/reports/220420-lhlh3afbh5/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

SmokeLoader

Malware Config

C2 Extraction:

http://coralee.at/upload/
http://ducvietcao.com/upload/
http://biz-acc.ru/upload/
http://toimap.com/upload/
http://bbb7d.com/upload/
http://piratia-life.ru/upload/
http://curvreport.com/upload/
http://viagratos.com/upload/
http://mordo.ru/upload/
http://pkodev.net/upload/