MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e117ab73135daaf6ba70b814c9a63dd797070015351f02e0abb17ca767fa3ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 9

Intelligence 9 IOCs YARA File information Comments

SHA256 hash:	9e117ab73135daaf6ba70b814c9a63dd797070015351f02e0abb17ca767fa3ae
SHA3-384 hash:	e339d17e75518cf9949c97444f26d8ab2684246535d0b1486177a15820d450c2d428bd8bfc65b2dbc5a7a69b8a02e84c
SHA1 hash:	05f24f64f6c307d358fdc23dfd657df40542e235
MD5 hash:	5d9aee51873d7250d36eb8b58900c9f7
humanhash:	diet-cup-one-item
File name:	5d9aee51873d7250d36eb8b58900c9f7.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	259'776 bytes
First seen:	2022-02-19 15:58:54 UTC
Last seen:	2022-02-19 17:51:39 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	3a6dba6c84409e1cce26d4097ba2cb7b (5 x Smoke Loader, 1 x AgentTesla, 1 x GuLoader)
ssdeep	3072:3Wum2MgoruOjA4XQlIfwRr9PDcveIm2M7Wm:3fmRgoxjQxRr9PjImR7z
TLSH	T1F5446C57F280A9B5F521C5BC5813F0AA58C63C7981208759BFD47E48E4362AE6363F3E
File icon (PE):
dhash icon	72c2e0e4ce92f278 (7 x Smoke Loader, 2 x GuLoader, 1 x AgentTesla)
Reporter	abuse_ch
Tags:	exe signed Smoke Loader

Code Signing Certificate

Organisation:	Appeachers6
Issuer:	Appeachers6
Algorithm:	sha256WithRSAEncryption
Valid from:	2022-02-17T21:24:11Z
Valid to:	2023-02-17T21:24:11Z
Serial number:	00
Intelligence:	325 malware samples on MalwareBazaar are signed with this code signing certificate
Cert Central Blocklist:	This certificate is on the Cert Central blocklist
Thumbprint Algorithm:	SHA256
Thumbprint:	c1a1bffa70fb7f1f87a58e6a3d06156c0bfb0981d4c8ed460491f7fc3d3054f0
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

306

Origin country :

n/a

Vendor Threat Intelligence

Detection:

GuLoader

Link:

https://www.capesandbox.com/analysis/242682/

Detection(s):

SecuriteInfo.com.Variant.Fragtor.60870.19722.3263.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a window

Sending a custom TCP request

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

overlay packed

Link:

https://www.filescan.io/uploads/621113cca2660f3bb90782b1/reports/de92cdad-3396-4342-909c-148e4fa376ef/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

GuLoader

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8ce2ebcf-9530-4b04-8bd9-1554717ded0b

Result

Threat name:

AgentTesla SmokeLoader

Detection:

malicious

Classification:

evad.troj.spyw

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/942640

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Found malware configuration

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Yara detected AgentTesla

Yara detected SmokeLoader

Yara detected Telegram RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

agenttesla

Link:

https://mwdb.cert.pl/sample/9e117ab73135daaf6ba70b814c9a63dd797070015351f02e0abb17ca767fa3ae/

Threat name:

Win32.Trojan.GuLoader

Status:

Malicious

First seen:

2022-02-18 04:30:04 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

17 of 28 (60.71%)

Threat level:

5/5

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:agenttesla family:guloader family:smokeloader backdoor collection downloader keylogger spyware stealer suricata trojan

Link:

https://tria.ge/reports/220219-te3l6sbedr/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

outlook_office_path

outlook_win_path

Program crash

Drops file in Windows directory

Suspicious use of NtCreateThreadExHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Checks QEMU agent file

Loads dropped DLL

Downloads MZ/PE file

Executes dropped EXE

AgentTesla Payload

AgentTesla

Guloader,Cloudeye

SmokeLoader

Suspicious use of NtCreateProcessExOtherParentProcess

suricata: ET MALWARE Generic .bin download from Dotted Quad

Malware Config

C2 Extraction:

https://api.telegram.org/bot5013020608:AAFu_btAZRcQ9V-SvEIxL9rCbb_x1A-9IJo/sendDocument
http://venis.ml/
http://tootoo.ga/
http://eyecosl.ga/
http://bullions.tk/
http://mizangs.tw/
http://xpowebs.ga/