MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a60eba931c6438e60aed1b8a049a79cb6e53a28b84897c3963836c7d1e750c81. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a60eba931c6438e60aed1b8a049a79cb6e53a28b84897c3963836c7d1e750c81
SHA3-384 hash: d384cd8c3ba0fae0385b48aa41d8b24940c70bf0016b56ff4cc113436014451ee82f8c1ee846c11df43bc85a14f163ff
SHA1 hash: dbff7d815083faf53db85440402404f85424c99c
MD5 hash: a19ddedb140dec9232c60a8719044f0e
humanhash: coffee-harry-helium-blossom
File name:SecuriteInfo.com.W32.AIDetect.malware2.29567.18434
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:299'520 bytes
First seen:2021-03-14 17:52:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 5e01395680024e2c9af5d940d3604ea7 (4 x ArkeiStealer, 2 x Smoke Loader, 1 x Gozi)
ssdeep 6144:BRBcetwdy6P36ye3gPJMX0ewy9e8mzc/hpI6IPuTsHAuMMMMiMMFe:BFtwI6PDkgPJMXNxlmw5pY2wguMMMMix
Threatray 245 similar samples on MalwareBazaar
TLSH A5546C20B7A1C434F4F305B556B686F8A9347D31973880CF62C47A5B5A386EAED31B53
Reporter SecuriteInfoCom
Tags:Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
205
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.W32.AIDetect.malware2.29567.18434
Verdict:
Suspicious activity
Analysis date:
2021-03-14 17:56:06 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/879c77c3-382e-4f62-9c8c-88e4f8806962

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/124221/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware2.29567.18434.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Connection attempt
Sending an HTTP POST request
Deleting of the original file
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Tofsee Xmrig
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/638922
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
Benign windows process drops PE files
Binary contains a suspicious time stamp
Changes security center settings (notifications, updates, antivirus, firewall)
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to infect the boot sector
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Creates files in alternative data streams (ADS)
Deletes itself after installation
Detected Stratum mining protocol
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops executables to the windows directory (C:\Windows) and starts them
Found many strings related to Crypto-Wallets (likely being stolen)
Found strings related to Crypto-Mining
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
May check the online IP address of the machine
Modifies the windows firewall
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Renames NTDLL to bypass HIPS
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Instant Messenger accounts or passwords
Uses known network protocols on non-standard ports
Uses netsh to modify the Windows network and firewall settings
Writes to foreign memory regions
Yara detected Tofsee
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 368438 Sample: SecuriteInfo.com.W32.AIDete... Startdate: 14/03/2021 Architecture: WINDOWS Score: 100 81 api.ip.sb 2->81 83 z-p42-instagram.c10r.facebook.com 2->83 85 13 other IPs or domains 2->85 109 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->109 111 Multi AV Scanner detection for domain / URL 2->111 113 Malicious sample detected (through community Yara rule) 2->113 115 17 other signatures 2->115 10 SecuriteInfo.com.W32.AIDetect.malware2.29567.exe 1 2->10         started        13 ilrlalwc.exe 2->13         started        15 vbfchtu 1 2->15         started        18 9 other processes 2->18 signatures3 process4 dnsIp5 131 Detected unpacking (changes PE section rights) 10->131 133 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 10->133 135 Renames NTDLL to bypass HIPS 10->135 153 2 other signatures 10->153 21 explorer.exe 6 10->21 injected 137 Detected unpacking (overwrites its own PE header) 13->137 139 Writes to foreign memory regions 13->139 141 Allocates memory in foreign processes 13->141 143 Injects a PE file into a foreign processes 13->143 26 svchost.exe 3 1 13->26         started        77 C:\Users\user\AppData\Local\Temp\CC4F.tmp, PE32 15->77 dropped 145 Multi AV Scanner detection for dropped file 15->145 147 Machine Learning detection for dropped file 15->147 149 Maps a DLL or memory area into another process 15->149 87 127.0.0.1 unknown unknown 18->87 151 Changes security center settings (notifications, updates, antivirus, firewall) 18->151 file6 signatures7 process8 dnsIp9 89 91.203.5.155, 49745, 80 VOLIA-ASUA Ukraine 21->89 91 146.0.77.18, 49737, 80 HOSTKEY-ASNL Netherlands 21->91 97 9 other IPs or domains 21->97 67 C:\Users\user\AppData\Roaming\vbfchtu, PE32 21->67 dropped 69 C:\Users\user\AppData\Local\Temp\2DED.exe, PE32 21->69 dropped 71 C:\Users\user\AppData\Local\Temp\19E7.exe, PE32 21->71 dropped 73 C:\Users\user\...\vbfchtu:Zone.Identifier, ASCII 21->73 dropped 117 System process connects to network (likely due to code injection or exploit) 21->117 119 Benign windows process drops PE files 21->119 121 Deletes itself after installation 21->121 123 Hides that the sample has been downloaded from the Internet (zone.identifier) 21->123 28 A214.exe 21->28         started        31 2DED.exe 2 21->31         started        34 19E7.exe 21->34         started        36 B2DE.exe 21->36         started        93 144.76.108.82, 421, 49772, 49778 HETZNER-ASDE Germany 26->93 95 work.a-poster.info 37.1.217.172, 25000, 50174 SCALAXY-ASNL Ukraine 26->95 99 19 other IPs or domains 26->99 75 C:\Windows\SysWOW64\...\systemprofile:.repos, data 26->75 dropped 125 Creates files in alternative data streams (ADS) 26->125 127 Injects a PE file into a foreign processes 26->127 38 svchost.exe 26->38         started        file10 129 Detected Stratum mining protocol 93->129 signatures11 process12 dnsIp13 159 Detected unpacking (changes PE section rights) 28->159 161 Detected unpacking (overwrites its own PE header) 28->161 163 Contains functionality to inject code into remote processes 28->163 165 Injects a PE file into a foreign processes 28->165 41 A214.exe 28->41         started        79 C:\Users\user\AppData\Local\...\ilrlalwc.exe, PE32 31->79 dropped 167 Machine Learning detection for dropped file 31->167 45 cmd.exe 2 31->45         started        47 netsh.exe 3 31->47         started        49 cmd.exe 1 31->49         started        51 3 other processes 31->51 169 Contains functionality to infect the boot sector 34->169 101 msr.pool-pay.com 176.9.119.47, 49797, 6199 HETZNER-ASDE Germany 38->101 file14 signatures15 process16 dnsIp17 103 45.153.186.175, 49943, 50001, 80 MVPShttpswwwmvpsnetEU Bulgaria 41->103 105 elb097307-934924932.us-east-1.elb.amazonaws.com 50.19.96.218, 49942, 80 AMAZON-AESUS United States 41->105 107 2 other IPs or domains 41->107 155 Tries to steal Instant Messenger accounts or passwords 41->155 157 Tries to harvest and steal browser information (history, passwords, etc) 41->157 53 conhost.exe 45->53         started        55 conhost.exe 45->55         started        57 conhost.exe 47->57         started        59 conhost.exe 49->59         started        61 conhost.exe 51->61         started        63 conhost.exe 51->63         started        65 conhost.exe 51->65         started        signatures18 process19
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a60eba931c6438e60aed1b8a049a79cb6e53a28b84897c3963836c7d1e750c81/
Threat name:
Win32.Trojan.Glupteba
Create hunting rule
Status:
Malicious
First seen:
2021-03-14 15:25:59 UTC
AV detection:
15 of 27 (55.56%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
3bd0eb640c37fb31423b560aeb5bf4f9f6117cb60c2a9e4509b7a0db80e0a092
Smoke Loader
74bbc2a055be8f2717fa06e764b100d02f9a1d9c2a026d281fbbbbb47b655199
Smoke Loader
75973aa6b9ede942a1a0ec330218c3a2bee3d2de638482592f1f60976898ca81
Smoke Loader
7f40d0fe270f72aec76ec5348630f3b354ea4dd010d60edcdd865693824981de
Smoke Loader
87e1e8b1fb643ea3665a8d6994bf5f7f9b48ce07218ef488d49f95142eac0eaa
Smoke Loader
ab9e78f844176f90e2815978b083362683d6080da73034a019de13489aa125e7
Smoke Loader
b2accff6cdcb8f4b5cbf2e493a8474f9e444a12be5f46d54a925bbe4a43a0703
Smoke Loader
c684906ca32b3dd720ecc86aa54ca56a69f8300e112bd3af5f54d569e9e5ba27
Smoke Loader
d4e87e3eb3e3a5e08db5a708bd95fedac322088446c87ba37f0aeca529a928cc
Smoke Loader
f69bdd82ca22268d090832707e37b1cae408ba96476843b55feedac11acc6277
Smoke Loader
+ 235 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:redline family:smokeloader family:tofsee family:xmrig backdoor bootkit discovery evasion infostealer miner persistence spyware stealer themida trojan
Link:
https://tria.ge/reports/210314-gd189elxm2/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Launches sc.exe
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Checks whether UAC is enabled
Looks up external IP address via web service
Writes to the Master Boot Record (MBR)
Checks BIOS information in registry
Deletes itself
Loads dropped DLL
Reads local data of messenger clients
Reads user/profile data of web browsers
themida
Creates new service(s)
Executes dropped EXE
Modifies Windows Firewall
Sets service image path in registry
Identifies VirtualBox via ACPI registry values (likely anti-VM)
XMRig Miner Payload
RedLine
SmokeLoader
Suspicious use of NtCreateProcessExOtherParentProcess
Tofsee
Windows security bypass
xmrig
Malware Config
C2 Extraction:
http://funzel.info/upload/
http://doeros.xyz/upload/
http://vromus.com/upload/
http://hqans.com/upload/
http://vxeudy.com/upload/
http://poderoa.com/upload/
http://nezzzo.com/upload/
Unpacked files
SH256 hash:
d39bc8519a68915ed5542a94b1195baebb83b82f422b3015453ef824cc836032
MD5 hash:
f3cf5d2ef1ad166597b17325c008b597
SHA1 hash:
224f097302573d81c8ee85fc6bddef6fed4aeab8
Link:
https://www.unpac.me/results/85c31a16-b897-482b-bfea-77cd1670590d/
SH256 hash:
a60eba931c6438e60aed1b8a049a79cb6e53a28b84897c3963836c7d1e750c81
MD5 hash:
a19ddedb140dec9232c60a8719044f0e
SHA1 hash:
dbff7d815083faf53db85440402404f85424c99c
Link:
https://www.unpac.me/results/85c31a16-b897-482b-bfea-77cd1670590d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Glupteba
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a60eba931c6438e60aed1b8a049a79cb6e53a28b84897c3963836c7d1e750c81

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_smokeloader_a2
Create hunting rule
Author:pnx

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe a60eba931c6438e60aed1b8a049a79cb6e53a28b84897c3963836c7d1e750c81

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1066920/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/124221/

Comments