MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e6ce673dc161fc54b110782f18ec9bb3690b9ccdde494196ccb5bb0381dfa94. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 15


Intelligence 15 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9e6ce673dc161fc54b110782f18ec9bb3690b9ccdde494196ccb5bb0381dfa94
SHA3-384 hash: 599b3b5b6cf6988cfe4656679315352e981ac96918944084fd12494daac699e6a49df416cfda57838f6d4e5b8a12df9f
SHA1 hash: 304161c0718d7f89489a722aab079bea2d244c3c
MD5 hash: e48aed8d0d36c84893d0138380cfa502
humanhash: lemon-spring-island-april
File name:9e6ce673dc161fc54b110782f18ec9bb3690b9ccdde494196ccb5bb0381dfa94
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:266'752 bytes
First seen:2023-07-06 12:20:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6697fa255a05fffbb8331cc121287cb1 (2 x GCleaner, 1 x CoinMiner, 1 x TeamBot)
ssdeep 3072:wM1uSnn2s90r+1fRCpYM11PuVn6NCy2L0rshPXW/02QMG/uLLRKx:RuBs90r+1fIZ1PuVn4Cy2HPP
Threatray 4'865 similar samples on MalwareBazaar
TLSH T14E446D0362F17E61E52647329E2EC6E8365FFA618F5E3766221C5AAF05B02F1D273350
TrID 37.3% (.EXE) Win64 Executable (generic) (10523/12/4)
17.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
16.0% (.EXE) Win32 Executable (generic) (4505/5/1)
7.3% (.ICL) Windows Icons Library (generic) (2059/9)
7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 0160625042426600 (1 x Smoke Loader)
Reporter adrian__luca
Tags:exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
289
Origin country :
HU HU
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
9e6ce673dc161fc54b110782f18ec9bb3690b9ccdde494196ccb5bb0381dfa94
Verdict:
No threats detected
Analysis date:
2023-07-06 12:17:27 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a3966977-e8ce-4829-933d-848a52b74e48

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
SmokeLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/409298/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.67805985.20716.26787.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Sending an HTTP POST request
Launching a process
Reading critical registry keys
Creating a file in the %temp% directory
Creating a process from a recently created file
Setting browser functions hooks
Stealing user critical data
Unauthorized injection to a system process
Enabling autorun by creating a file
Unauthorized injection to a browser process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
crypter glupteba greyware packed
Link:
https://www.filescan.io/uploads/64a6b1b4a19f5dcc59aa0495/reports/59722706-eec0-41b5-b865-1f31ab31b13d/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/9e6ce673dc161fc54b110782f18ec9bb3690b9ccdde494196ccb5bb0381dfa94
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/febe5006-2444-48c7-a8d9-abde3408c215
Result
Threat name:
SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1268107
Signature
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1268107 Sample: EchMdqhUwg.exe Startdate: 06/07/2023 Architecture: WINDOWS Score: 100 37 Multi AV Scanner detection for domain / URL 2->37 39 Found malware configuration 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 6 other signatures 2->43 7 EchMdqhUwg.exe 2->7         started        10 hsteivu 2->10         started        process3 signatures4 53 Detected unpacking (changes PE section rights) 7->53 55 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 7->55 57 Maps a DLL or memory area into another process 7->57 59 Creates a thread in another existing process (thread injection) 7->59 12 explorer.exe 3 4 7->12 injected 61 Multi AV Scanner detection for dropped file 10->61 63 Machine Learning detection for dropped file 10->63 65 Checks if the current machine is a virtual machine (disk enumeration) 10->65 process5 dnsIp6 33 bloomberg.ga 193.106.175.162, 49702, 49703, 80 IQHOSTRU Russian Federation 12->33 35 suprememax.ga 12->35 27 C:\Users\user\AppData\Roaming\hsteivu, PE32 12->27 dropped 29 C:\Users\user\...\hsteivu:Zone.Identifier, ASCII 12->29 dropped 67 System process connects to network (likely due to code injection or exploit) 12->67 69 Benign windows process drops PE files 12->69 71 Injects code into the Windows Explorer (explorer.exe) 12->71 73 3 other signatures 12->73 17 explorer.exe 6 12->17         started        21 explorer.exe 12->21         started        23 explorer.exe 12->23         started        25 4 other processes 12->25 file7 signatures8 process9 dnsIp10 31 bloomberg.ga 17->31 45 System process connects to network (likely due to code injection or exploit) 17->45 47 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 17->47 49 Tries to steal Mail credentials (via file / registry access) 17->49 51 Tries to harvest and steal browser information (history, passwords, etc) 17->51 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9e6ce673dc161fc54b110782f18ec9bb3690b9ccdde494196ccb5bb0381dfa94/
Threat name:
Win32.Trojan.Lockbit
Create hunting rule
Status:
Malicious
First seen:
2023-06-27 08:56:56 UTC
File Type:
PE (Exe)
Extracted files:
38
AV detection:
31 of 38 (81.58%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tzwom464cyp4ksyra6bpddwjxm3jboom3xsjiglmznn3aoa57kka._file
Verdict:
malicious
Similar samples:
0ab54468721453d7237df27d4dd6383366edb5cc3bfab9a20d48a2416ca2aed8
Smoke Loader
8113159e0ac7c44fb49f3231ea9541e2d9ce9fd06dee9887037349e3370e6e73
Smoke Loader
87f58956937f84708706f515675d0b48125ace13ede701886e433cc8b336720d
Smoke Loader
8bcef7f2318c046a3e75cd30dc002ebbf60d55c669a73e861c2bf1bb76dc9010
Smoke Loader
c62d6a8f03122f152f75051babb0a9ad178223ae33a2205caf5675f29cf3cef3
Smoke Loader
cd621988496f0c54d5e56cc9d0f1fd944c82dcab5eb66b294e456b85a962aaad
Smoke Loader
d2349196b611e963c2099768c35e7b9de02436e1bccfe1b49d8311c41cd1ef55
Smoke Loader
+ 4'855 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor collection trojan
Link:
https://tria.ge/reports/230706-pjbl2acb31/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
outlook_win_path
Accesses Microsoft Outlook profiles
SmokeLoader
Malware Config
C2 Extraction:
http://suprememax.ga/
http://bloomberg.ga/
Unpacked files
SH256 hash:
0d1951f30938c16071c93a0b4c1081245b94236181012e93faad06fdcf3838dc
MD5 hash:
ee0e4eff207e538c0a67848818d89cfd
SHA1 hash:
af73c67b37e5a4265988b7b368cf5b18d3328746
Detections:
SmokeLoaderStage2
Create hunting rule
win_smokeloader_a2
Create hunting rule
Link:
https://www.unpac.me/results/915acaf4-0ac2-47dc-b090-dd10122a743f/
Parent samples :
2c4cefea32bcd7a2b3fce9441b265f7c4aa36a7dc54ddf4964a6b799266760cf
8113159e0ac7c44fb49f3231ea9541e2d9ce9fd06dee9887037349e3370e6e73
d896e1c6f1124eb8cf19f29d2dec8d35203cfd4ea36636549e178a1a06de10db
57c2cea33c310ad66d76c408ba1437f59f2172e77a96f353f568fa9ec8854a35
b010a749d181fa2a1ad4bf78d84043a1fa334900029b86947a11990a6cb1db3e
4fce1d0099d746c09f6e7a8ae41882cbb95070ab24843b1516b8a74ce65d3701
9e6ce673dc161fc54b110782f18ec9bb3690b9ccdde494196ccb5bb0381dfa94
SH256 hash:
9e6ce673dc161fc54b110782f18ec9bb3690b9ccdde494196ccb5bb0381dfa94
MD5 hash:
e48aed8d0d36c84893d0138380cfa502
SHA1 hash:
304161c0718d7f89489a722aab079bea2d244c3c
Link:
https://www.unpac.me/results/915acaf4-0ac2-47dc-b090-dd10122a743f/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9e6ce673dc16/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9e6ce673dc161fc54b110782f18ec9bb3690b9ccdde494196ccb5bb0381dfa94

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/409298/

Comments