MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 9d213a0d0a6afd219629b917c20e53c97443b21b2ce41574d5316720ee2793a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Smoke Loader
Vendor detections: 15
| SHA256 hash: | 9d213a0d0a6afd219629b917c20e53c97443b21b2ce41574d5316720ee2793a2 |
|---|---|
| SHA3-384 hash: | 162ca942762f1a4226c40d0c90fc1806d4b3b29e8df9ead6a64ff4a3ee736b3d83605cdce100cb0211f1eac52b8bbf80 |
| SHA1 hash: | 450fe690909703389354fda87dc06775dd7c0b0c |
| MD5 hash: | d4e8cb2c2757668aa95e281a22c52cef |
| humanhash: | earth-five-earth-hawaii |
| File name: | dx13.exe |
| Download: | download sample |
| Signature | Smoke Loader |
| File size: | 2'953'632 bytes |
| First seen: | 2022-03-24 18:07:18 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | fcf1390e9ce472c7270447fc5c61a0c1 (863 x DCRat, 118 x NanoCore, 94 x njrat) |
| ssdeep | 49152:UbA30Z/Scrx0pUg3VyYEcz/Fm4Az+sgKJrznpojKYCITo3I98LyWsVwkvpD+:UbNx7glG94Az+sJrDpojKYCH49Cw2kvk |
| Threatray | 11'274 similar samples on MalwareBazaar |
| TLSH | T1CAD52312B6C198B1D2A209319E789B08263DBC241F198EEFB3F4166EDD750D0DA35B37 |
| File icon (PE): |  |
| dhash icon | 9494b494d4aeaeac (832 x DCRat, 172 x RedLineStealer, 134 x CryptOne) |
| Reporter |  adm1n_usa32 |
| Tags: | exe Smoke Loader Socelars |
Intelligence
File Origin
# of uploads :
1
# of downloads :
217
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
socelars
ID:
1
File name:
dx13.exe
Verdict:
Malicious activity
Analysis date:
2022-03-24 18:10:15 UTC
Tags:
evasion socelars stealer trojan
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Fabookie
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file
Creating a process from a recently created file
Launching a process
Creating a file in the Program Files directory
Creating a file in the %temp% directory
DNS request
Sending an HTTP GET request
Creating a process with a hidden window
Reading critical registry keys
Searching for the browser window
Sending a custom TCP request
Sending a UDP request
Launching the default Windows debugger (dwwin.exe)
Running batch commands
Unauthorized injection to a recently created process
Query of malicious DNS domain
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Launching a tool to kill processes
Sending an HTTP GET request to an infection source
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
6/10
Tags:
n/a
Behaviour
MalwareBazaar
MeasuringTime
EvasionQueryPerformanceCounter
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
80%
Tags:
facebook glupteba greyware makop overlay packed setupapi.dll shdocvw.dll shell32.dll smokeloader socelars update.exe
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Socelars
Verdict:
Malicious
Result
Threat name:
Nitol SmokeLoader Socelars
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
Checks if the current machine is a virtual machine (disk enumeration)
Connects to a pastebin service (likely for C&C)
Contains functionality to compare user and computer (likely to detect sandboxes)
Contains functionality to detect sleep reduction / modifications
Contains functionality to infect the boot sector
Contains functionality to inject code into remote processes
Contains functionality to inject threads in other processes
Creates a thread in another existing process (thread injection)
Creates multiple autostart registry keys
DLL reload attack detected
Drops PE files to the document folder of the user
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Performs DNS queries to domains with low reputation
Query firmware table information (likely to detect VMs)
Renames NTDLL to bypass HIPS
Sets debug register (to hijack the execution of another thread)
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Yara detected Nitol
Yara detected SmokeLoader
Yara detected Socelars
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.RedLineStealer
Status:
Malicious
First seen:
2021-04-11 00:46:48 UTC
File Type:
PE (Exe)
Extracted files:
175
AV detection:
22 of 26 (84.62%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
+ 11'264 additional samples on MalwareBazaar
Result
Malware family:
socelars
Score:
10/10
Tags:
family:smokeloader family:socelars backdoor evasion persistence spyware stealer trojan upx
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Enumerates system info in registry
Kills process with taskkill
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Looks up external IP address via web service
Checks computer location settings
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Executes dropped EXE
UPX packed file
SmokeLoader
Socelars
Socelars Payload
Suspicious use of NtCreateUserProcessOtherParentProcess
Malware Config
C2 Extraction:
http://www.fddnice.pw/
http://www.sokoinfo.pw/
http://www.zzhlike.pw/
http://www.wygexde.xyz/
http://perseus007.xyz/upload/
http://lambos1.xyz/upload/
http://cipluks.com/upload/
http://ragnar77.com/upload/
http://aslauk.com/upload/
http://qunersoo.xyz/upload /
http://hostunes.info/upload/
http://leonisdas.xyz/upload/
http://www.sokoinfo.pw/
http://www.zzhlike.pw/
http://www.wygexde.xyz/
http://perseus007.xyz/upload/
http://lambos1.xyz/upload/
http://cipluks.com/upload/
http://ragnar77.com/upload/
http://aslauk.com/upload/
http://qunersoo.xyz/upload /
http://hostunes.info/upload/
http://leonisdas.xyz/upload/
Unpacked files
SH256 hash:
f2192db8bd4c494a5188480e90ccb75252ede37020256d706b7a779954fde918
MD5 hash:
a02078be244403d79c262a3880d55529
SHA1 hash:
cc5f5cff00e7ac0dd8a69043aa9acc0beaefc367
SH256 hash:
0c2ade2993927f6de828e30c07156c19751b55650a05c965631ca0ea1c983498
MD5 hash:
cc0d6b6813f92dbf5be3ecacf44d662a
SHA1 hash:
b968c57a14ddada4128356f6e39fb66c6d864d3f
SH256 hash:
55361941ab12c7edd987c706d25423d868f756fab1028d99eeffacdabf3da4ca
MD5 hash:
4de4b7bc0a92902422c4204fcfa58150
SHA1 hash:
587e0299ea32cc836281998941daa60f471e3480
SH256 hash:
40ca14be87ccee1c66cce8ce07d7ed9b94a0f7b46d84f9147c4bbf6ddab75a67
MD5 hash:
7165e9d7456520d1f1644aa26da7c423
SHA1 hash:
177f9116229a021e24f80c4059999c4c52f9e830
SH256 hash:
bf5b31063ae254fad48cb5d152cbd103f3b5039db0452bd734fa125955778ceb
MD5 hash:
7b42af79b6a0b1cea631b65d06f5b0f9
SHA1 hash:
5d56e95b6977e7adf9c68038eeb46e61469c43db
SH256 hash:
fbf00683cc2e16d0206aa30c805d60dff3156082d4613a77e195a96efd086710
MD5 hash:
6c40c4289bbb0aec17c2b1924188fa10
SHA1 hash:
ac171ad414b296933ec7d58a06495354d24b2557
SH256 hash:
2cfd1896c2729c539ebc4b9c98407f2b4023be2ec6a1c926ee736fd6ff4fd302
MD5 hash:
a9634568e90ce162f55442f1282c8fca
SHA1 hash:
4ce55c3b80d1d3955fc589b3486cad9d0bbf815d
SH256 hash:
39ed68982fd0243c6e50b57162182e415b85871e4a83f764f607a1b64e587d04
MD5 hash:
eca4350cdab1176e63fea22f9597e821
SHA1 hash:
c0110a45cdbc0012122eb970a4680e0b303444cd
SH256 hash:
4b4f8c66c33cb40092685ed618b87f0eec557d6beb86b4907cfb2311d0a95a1f
MD5 hash:
566585a275aab4b39ecd5a559adc0261
SHA1 hash:
8f63401f6fd12666c6d40545eab325ed981ed565
SH256 hash:
b1396125353ad6357bf1eb7f606c930deb1dc99c3ca1c94ec374474640486b4e
MD5 hash:
5b18d9d1fecdd00f8afa1fe1a6a5892e
SHA1 hash:
26d45ab126633d94e6fde25cab6f8f4f180207ef
SH256 hash:
b6972585b8ab83a7b0dd651e191c169c06a67205059636a7787da1cd2df0a23e
MD5 hash:
d5ee13a118711a18444d4e8931c21bee
SHA1 hash:
54d9940c84cc13c3cb4813ed4b98cfa2f6c3da0e
SH256 hash:
07173f360bfc859985d0737e7f7288bd0774d705626396e77aaf862e7114187e
MD5 hash:
8e419990a6fbfdf725856156c8e8d495
SHA1 hash:
c2e7bec6ef5f078e72bae672bf9e984d7a91192e
SH256 hash:
816b3cb72c986209b69ff867c282b2d5a87d179704daa0e53cb8a9879ef1a62d
MD5 hash:
ecb50727932e9dc0094302fe7481775e
SHA1 hash:
adf0d75fcb7fa9d32818b657dd49154f24632c4d
Detections:
win_socelars_auto
SH256 hash:
bb4ebdf4f04b804d730117bf33cec6aeaa9c09a76de71f860d5299e0bf1f458a
MD5 hash:
d768aeb5135b3244da5a39834893a197
SHA1 hash:
fe3acd5476a3150dd474cd975093d645220f7912
SH256 hash:
9d213a0d0a6afd219629b917c20e53c97443b21b2ce41574d5316720ee2793a2
MD5 hash:
d4e8cb2c2757668aa95e281a22c52cef
SHA1 hash:
450fe690909703389354fda87dc06775dd7c0b0c
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | MALWARE_Win_Chebka |
|---|---|
| Author: | ditekSHen |
| Description: | Detects Chebka |
| Rule name: | MALWARE_Win_Fabookie |
|---|---|
| Author: | ditekSHen |
| Description: | Detects Fabookie / ElysiumStealer |
| Rule name: | SUSP_XORed_MSDOS_Stub_Message |
|---|---|
| Author: | Florian Roth |
| Description: | Detects suspicious XORed MSDOS stub message |
| Reference: | https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.https://app.any.run/tasks/7a44c33b-3cc4-400a-a313-7d1a15ea4aea