MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a3cb092aeb6fe6cb67b01fb5cd86906ebbd4093086496f52e405d62cc833e745. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a3cb092aeb6fe6cb67b01fb5cd86906ebbd4093086496f52e405d62cc833e745
SHA3-384 hash: cf451f9c2dc688235d546e21531d272aca920f5e168049ba4351004291bbeebc983f77dbc9659f8d007533986ae2f996
SHA1 hash: 16235a0e60a43a67dd0799cc1c8c064bb352600f
MD5 hash: 4becf9adc805ef0317b768d3ee122ce3
humanhash: twelve-six-one-fanta
File name:4becf9adc805ef0317b768d3ee122ce3
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:237'056 bytes
First seen:2022-11-16 17:13:05 UTC
Last seen:2022-11-16 19:52:16 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9d3c46448655d82ee7e7b980d48b2aab (5 x Smoke Loader, 2 x Tofsee, 2 x Amadey)
ssdeep 3072:8XO++i+1L6VJcJDWdyynS6MoWbzvliLQRBFGzdhA/kPUSyJZ9:4P+1L6YJDWdfSy0LqWvghbPtyj9
TLSH T10134CF017992C873C49E40309474DBE5667ABD32292E4847F7A83B6E6F302F1A6B7717
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 480c1c4c4f590b04 (26 x Amadey, 24 x Smoke Loader, 7 x Tofsee)
Reporter zbetcheckin
Tags:32 exe Smoke Loader

Intelligence

File Origin
# of uploads :
2
# of downloads :
220
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
4becf9adc805ef0317b768d3ee122ce3
Verdict:
No threats detected
Analysis date:
2022-11-16 17:15:02 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/3e6edb09-c30c-4690-acde-cc5c1de29a73

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
SmokeLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/334946/
Detection(s):
SecuriteInfo.com.Win32.BotX-gen.24296.17262.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Sending an HTTP GET request
Creating a process from a recently created file
Searching for synchronization primitives
Query of malicious DNS domain
Sending a TCP request to an infection source
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware lockbit packed
Link:
https://www.filescan.io/uploads/63751a5a6fda73cab64e17c8/reports/eb2cf341-d663-46e3-ade7-85a0ea2aa540/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/df2d039e-4845-4762-beed-394715d5660a
Result
Threat name:
SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1115080
Signature
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected SmokeLoader
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 747776 Sample: 6S9v5JK6Il.exe Startdate: 16/11/2022 Architecture: WINDOWS Score: 100 52 Snort IDS alert for network traffic 2->52 54 Multi AV Scanner detection for domain / URL 2->54 56 Malicious sample detected (through community Yara rule) 2->56 58 7 other signatures 2->58 8 6S9v5JK6Il.exe 2->8         started        11 cwrtsbs 2->11         started        13 EDDA.exe 2->13         started        process3 signatures4 68 Detected unpacking (changes PE section rights) 8->68 70 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 8->70 72 Maps a DLL or memory area into another process 8->72 15 explorer.exe 6 8->15 injected 74 Machine Learning detection for dropped file 11->74 76 Checks if the current machine is a virtual machine (disk enumeration) 11->76 78 Creates a thread in another existing process (thread injection) 11->78 process5 dnsIp6 38 thepokeway.nl 5.135.247.111, 443, 49724 OVHFR France 15->38 40 freeshmex.at 31.166.210.3, 49705, 49707, 49714 MOBILY-ASEtihadEtisalatCompanyMobilySA Saudi Arabia 15->40 42 6 other IPs or domains 15->42 28 C:\Users\user\AppData\Roaming\cwrtsbs, PE32 15->28 dropped 30 C:\Users\user\AppData\Local\TempDDA.exe, PE32 15->30 dropped 32 C:\Users\user\AppData\Local\Temp\6E1B.exe, PE32 15->32 dropped 34 C:\Users\user\...\cwrtsbs:Zone.Identifier, ASCII 15->34 dropped 44 System process connects to network (likely due to code injection or exploit) 15->44 46 Benign windows process drops PE files 15->46 48 Deletes itself after installation 15->48 50 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->50 20 6E1B.exe 1 15->20         started        24 EDDA.exe 15->24         started        file7 signatures8 process9 file10 36 C:\Users\user\AppData\...\Qieppoeedtppeh.tmp, PE32 20->36 dropped 60 Multi AV Scanner detection for dropped file 20->60 62 Detected unpacking (changes PE section rights) 20->62 64 Detected unpacking (overwrites its own PE header) 20->64 26 rundll32.exe 1 20->26         started        66 Machine Learning detection for dropped file 24->66 signatures11 process12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a3cb092aeb6fe6cb67b01fb5cd86906ebbd4093086496f52e405d62cc833e745/
Threat name:
Win32.Trojan.BotX
Create hunting rule
Status:
Malicious
First seen:
2022-11-16 17:14:07 UTC
File Type:
PE (Exe)
Extracted files:
14
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=upfqskxln7tmwz5qd6243buqn255icjqqzew6uxeaxlczsbt45cq._file
Verdict:
malicious
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor trojan
Link:
https://tria.ge/reports/221116-vryz7acb62/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Suspicious use of SetThreadContext
Loads dropped DLL
Blocklisted process makes network request
Downloads MZ/PE file
Executes dropped EXE
Detects Smokeloader packer
SmokeLoader
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/04ee8b0e-d9c5-43c3-b138-3ec19fcad644
Unpacked files
SH256 hash:
d1b237da142111181f0129e590083a46a9a916e3fde28a9a807b285a167010b5
MD5 hash:
e25cff6dfd643f429e38c4431efc5302
SHA1 hash:
50c80c2ca2a501d6fa19018d45b9755054110fa1
Detections:
win_smokeloader_a2
Create hunting rule
SmokeLoaderStage2
Create hunting rule
Link:
https://www.unpac.me/results/84fa1238-3960-4983-8c55-64a1bd7abed2/
Parent samples :
ae8d22e0a37f24457ca15d1c4a55929d029841dd3900fba47de1511b489a6255
a3cb092aeb6fe6cb67b01fb5cd86906ebbd4093086496f52e405d62cc833e745
SH256 hash:
a3cb092aeb6fe6cb67b01fb5cd86906ebbd4093086496f52e405d62cc833e745
MD5 hash:
4becf9adc805ef0317b768d3ee122ce3
SHA1 hash:
16235a0e60a43a67dd0799cc1c8c064bb352600f
Link:
https://www.unpac.me/results/84fa1238-3960-4983-8c55-64a1bd7abed2/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a3cb092aeb6fe6cb67b01fb5cd86906ebbd4093086496f52e405d62cc833e745

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe a3cb092aeb6fe6cb67b01fb5cd86906ebbd4093086496f52e405d62cc833e745

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2414712/
  
URLhaus
https://urlhaus.abuse.ch/url/2414714/
Cape
Cape
https://www.capesandbox.com/analysis/334946/

Comments


Avatar
zbet commented on 2022-11-16 17:13:09 UTC

url : hxxps://ngaous.com/upload/ChromeSetup.exe