MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a51b880c04fcc66cc1c561b3b490b04db675f2775bbf1dfc299572d2401e706d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 17


Intelligence 17 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a51b880c04fcc66cc1c561b3b490b04db675f2775bbf1dfc299572d2401e706d
SHA3-384 hash: 1352059e7cbe3d6b84796422bc4b49e877fbb8680920e96884c81ca30a9b341497382bf746c0f62a09a1a392d568ea8a
SHA1 hash: 5950886a02ed459d9ffa92b98a1c4b0462e0de88
MD5 hash: dc076ed6da7792af479120129fad2716
humanhash: item-avocado-fifteen-hotel
File name:file
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:246'784 bytes
First seen:2023-06-06 13:20:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0af0c6e3fe2b48c822ae2dd664bde01d (2 x RedLineStealer, 1 x Smoke Loader)
ssdeep 3072:zfFQgZdMFWaC7RMgxSMGyfTuyyHM3IZcY+5wxv+mG+O3VKdFp7CnYTRqKV/c:zFQkMFxhgxSMGyyLUzSR+1+GXYM
Threatray 10 similar samples on MalwareBazaar
TLSH T16A342B0393E07D64E5294F3A8E2EC6EC775EF6518E597BA522289E2F04B01B3D1B3711
TrID 37.3% (.EXE) Win64 Executable (generic) (10523/12/4)
17.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
16.0% (.EXE) Win32 Executable (generic) (4505/5/1)
7.3% (.ICL) Windows Icons Library (generic) (2059/9)
7.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 001050a464444444 (1 x Smoke Loader)
Reporter jstrosch
Tags:exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
306
Origin country :
US US
Vendor Threat Intelligence
Malware family:
smoke
Create hunting rule
ID:
1
File name:
file
Verdict:
Malicious activity
Analysis date:
2023-06-06 13:23:37 UTC
Tags:
loader smoke trojan rat redline
Link:
https://app.any.run/tasks/abb6bba7-9d92-4fc5-ae04-ea8499099d3c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
SmokeLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/396141/
Detection(s):
SecuriteInfo.com.Variant.Ser.Zusy.4331.7565.11374.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Sending a custom TCP request
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Sending an HTTP POST request
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/89628/overview
Behaviour
MalwareBazaar
MeasuringTime
SystemUptime
EvasionGetTickCount
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/647f32c1ec981ee326c54431/reports/f0a7c805-765c-4eed-89a3-a2f6fab0cf31/overview
Verdict:
Malicious
Labled as:
Ser.Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/a51b880c04fcc66cc1c561b3b490b04db675f2775bbf1dfc299572d2401e706d
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/9c639832-c642-4670-805a-70d6941d34eb
Result
Threat name:
RedLine, SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1249572
Signature
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to infect the boot sector
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 882592 Sample: file.exe Startdate: 06/06/2023 Architecture: WINDOWS Score: 100 49 Snort IDS alert for network traffic 2->49 51 Multi AV Scanner detection for domain / URL 2->51 53 Found malware configuration 2->53 55 10 other signatures 2->55 7 file.exe 2->7         started        10 fjiesjd 2->10         started        12 24D0.exe 2->12         started        process3 signatures4 69 Detected unpacking (changes PE section rights) 7->69 71 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 7->71 73 Maps a DLL or memory area into another process 7->73 75 Creates a thread in another existing process (thread injection) 7->75 14 explorer.exe 1 7 7->14 injected 77 Multi AV Scanner detection for dropped file 10->77 79 Machine Learning detection for dropped file 10->79 81 Checks if the current machine is a virtual machine (disk enumeration) 10->81 process5 dnsIp6 35 201.119.66.140, 49703, 49710, 80 UninetSAdeCVMX Mexico 14->35 37 shsplatform.co.uk 80.66.203.53, 443, 49704 UKFASTGB United Kingdom 14->37 39 4 other IPs or domains 14->39 25 C:\Users\user\AppData\Roaming\fjiesjd, PE32 14->25 dropped 27 C:\Users\user\AppData\Local\Temp\998F.exe, PE32 14->27 dropped 29 C:\Users\user\AppData\Local\Temp\24D0.exe, PE32 14->29 dropped 31 C:\Users\user\...\fjiesjd:Zone.Identifier, ASCII 14->31 dropped 41 System process connects to network (likely due to code injection or exploit) 14->41 43 Benign windows process drops PE files 14->43 45 Deletes itself after installation 14->45 47 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->47 19 998F.exe 5 14->19         started        23 24D0.exe 14->23         started        file7 signatures8 process9 dnsIp10 33 185.81.68.115, 2920, 49711 KLNOPT-ASFI Finland 19->33 57 Detected unpacking (changes PE section rights) 19->57 59 Detected unpacking (overwrites its own PE header) 19->59 61 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 19->61 67 3 other signatures 19->67 63 Machine Learning detection for dropped file 23->63 65 Contains functionality to infect the boot sector 23->65 signatures11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a51b880c04fcc66cc1c561b3b490b04db675f2775bbf1dfc299572d2401e706d/
Threat name:
Win32.Trojan.Smokeloader
Create hunting rule
Status:
Malicious
First seen:
2023-06-06 13:21:07 UTC
File Type:
PE (Exe)
Extracted files:
55
AV detection:
21 of 24 (87.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uunyqdae7tdgzqofmgz3jefqjw3hl4txlo7r37bjsvzneqa6obwq._file
Verdict:
malicious
Similar samples:
09ab57049567b5c2e403f0901b5a9bcc7eab0ea6ae466c315695474c951d590f
Smoke Loader
11ba0763ef424bc59d9a2c722dd26df8528d3d0cc68bf2654e52b2b6a9c43da2
Smoke Loader
152e5b0db37e3db74698841e417e95f57cfb235c213b4dd6165e3ff0734e1700
Smoke Loader
17d6811a35be911a5dbe4f70d1b8e3e79032f05f21723fa4c9fb47946988ec05
Smoke Loader
2379723159ed6b1301813d5e06ae76370cb218b7f3b50c4bd4306db1682f2ccc
Smoke Loader
60e02417501b729855130e7591da7007dfab65da36c9baf8c4be4d94425398f6
Smoke Loader
784e57f9f685cf96c9320c00dd4d4b1df13033318e457e248b90945936896583
Smoke Loader
9656559ba6495dad4638722343efd32e08235bbf3989954d5bc40a57445a28e4
Smoke Loader
e131bcf15fec5a3a3ccf6b61bcd59c69d3cdced405a0a23f4604fa924539c1ef
Smoke Loader
e2d46d2b425da9d93663333937e8c28c5464a4daaf3e6c59ca0bbcf4478160ce
Smoke Loader
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader botnet:pub1 backdoor discovery spyware stealer trojan
Link:
https://tria.ge/reports/230606-qlm9aaed2s/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Program crash
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Executes dropped EXE
Reads user/profile data of web browsers
Downloads MZ/PE file
SmokeLoader
Malware Config
C2 Extraction:
http://toobussy.com/tmp/
http://wuc11.com/tmp/
http://ladogatur.ru/tmp/
http://kingpirate.ru/tmp/
Unpacked files
SH256 hash:
9e51c7d45f9edc3eb8f59f6a8b0dc4bcc716b5956171e6dde8bb51089b9c9a6a
MD5 hash:
e635ded1f5a9548bad84cc629f13d7de
SHA1 hash:
0603a76be16e973f2bc604f1aab4d396861b014d
Detections:
SmokeLoaderStage2
Create hunting rule
win_smokeloader_a2
Create hunting rule
Link:
https://www.unpac.me/results/0a72ef23-0359-4821-bd37-d6c431b0030e/
Parent samples :
a51b880c04fcc66cc1c561b3b490b04db675f2775bbf1dfc299572d2401e706d
8ba95cf7643edb6a572e660d541d96c8e1c138c76dd6e476c5943fe2d50ef59a
6e06846b13c0f90b5c2a600b9a95106cb7af27b8fe78dba06916263c780eddb4
13744be5698ffddc96d55415fdeebde4921ed199b4174251d83f1fd5b5a05c66
SH256 hash:
a51b880c04fcc66cc1c561b3b490b04db675f2775bbf1dfc299572d2401e706d
MD5 hash:
dc076ed6da7792af479120129fad2716
SHA1 hash:
5950886a02ed459d9ffa92b98a1c4b0462e0de88
Link:
https://www.unpac.me/results/0a72ef23-0359-4821-bd37-d6c431b0030e/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a51b880c04fc/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a51b880c04fcc66cc1c561b3b490b04db675f2775bbf1dfc299572d2401e706d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe a51b880c04fcc66cc1c561b3b490b04db675f2775bbf1dfc299572d2401e706d

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/396141/

Comments