MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a49a8b8dcab5bd8d0c52727eb11fa6a9951843fbb31c4ce185220b95c76daba0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 10

Intelligence 10 IOCs YARA File information Comments

SHA256 hash:	a49a8b8dcab5bd8d0c52727eb11fa6a9951843fbb31c4ce185220b95c76daba0
SHA3-384 hash:	e0bee84c294c890b61879a3d1056637ce9621fdf778cbb694dce2fe8438b3ab53ad8ae855054281931b0884f18b9d44d
SHA1 hash:	d41d4754754ac86f3db3054126a673cc94609ba5
MD5 hash:	eaa8180365dcb34a6a1427e6ea0984a1
humanhash:	lemon-whiskey-earth-neptune
File name:	eaa8180365dcb34a6a1427e6ea0984a1.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	145'408 bytes
First seen:	2021-11-05 07:16:21 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	a94f72041dffae69c763d924f92e2650 (2 x Smoke Loader, 1 x RedLineStealer, 1 x RaccoonStealer)
ssdeep	1536:FuC+V2TkXvHofC0AL1r1gKBgzxnHe4koxHH9WAvJgTUy0Vo1EwpIRhKFleTxC7Bw:F0gIXl0sJXyH9ZRlyR1h1FOrBtN+2f
Threatray	2'680 similar samples on MalwareBazaar
TLSH	T10AE39D2072F1C031E4A716708574DBB15F7BB8326674998B37AB367E5E603C09A3636B
File icon (PE):
dhash icon	480c1c4c4f594b14 (172 x Smoke Loader, 134 x RedLineStealer, 98 x Amadey)
Reporter	abuse_ch
Tags:	Dofoil exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

222

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

eaa8180365dcb34a6a1427e6ea0984a1.exe

Verdict:

No threats detected

Analysis date:

2021-11-05 07:17:28 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/2adddfd0-07e2-4564-a65d-1ea69e80b700

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/202557/

Detection(s):

SecuriteInfo.com.Trojan.Siggen15.35154.10297.17001.UNOFFICIAL

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware packed

Link:

https://www.filescan.io/uploads/6184da72c03a81a50241cfae/reports/78adbfc3-b6b9-45f8-886b-8ace2d419fc8/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/44f9f3d6-ff69-4c17-8aeb-80c324fcf841

Result

Threat name:

RedLine SmokeLoader

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/883762

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected RedLine Stealer

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a49a8b8dcab5bd8d0c52727eb11fa6a9951843fbb31c4ce185220b95c76daba0/

Threat name:

Win32.Backdoor.Mokes

Status:

Malicious

First seen:

2021-11-04 23:50:46 UTC

AV detection:

17 of 28 (60.71%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=usnixdokww6y2dcsoj7lch5gvgkrqq73wmoezymfeifzlr3nvoqa._file

Verdict:

malicious

Smoke Loader

14279e34ce19812a529d3f1cea16e54d57a40322ba34b63a85784d4fc5672992

Smoke Loader

218ae2e9ccd0d778ca78c7aa8e9fd7101819507d0f9da4bfbc40687063bd7fd4

Smoke Loader

378f7ddd4c6c6d9203f02fb422b5c156e5b541883c7a312133e4b0bfea21d64b

Smoke Loader

5eff7e99184b9c8352125aaf8aa9d72e33049c52dc4eb7a69d509da3e7004cb2

Smoke Loader

672c2343ecbaba5e397027a9a13a04ef46e9d7036ae7a4ebf32336e3708d2af8

Smoke Loader

8999c280aca7419a8b6fe0be172723fb66f18fc1439fb2ffa463d9315b79535d

Smoke Loader

d3184ceae376a789ccd61e767da3f21cacd72dfc7162a5e1a9569c7244d0bf9a

Smoke Loader

df2cda7268742a64ff9f639ea838b375b3a0d12bcf01afec13bccafb8abdefe1

Smoke Loader

+ 2'670 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor trojan

Link:

https://tria.ge/reports/211105-h4dhssaha2/

Behaviour

Checks SCSI registry key(s)

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Deletes itself

Drops startup file

Downloads MZ/PE file

Executes dropped EXE

SmokeLoader

Malware Config

C2 Extraction:

http://misha.at/upload/
http://roohaniinfra.com/upload/
http://0axqpcc.cn/upload/
http://mayak-lombard.ru/upload/
http://mebel-lass.ru/upload/
http://dishakhan.com/upload/