MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a63dbe18cf6ff766405f06066655fca8fcdf2bfe2a0147006d3d29ef00734fc4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 12

Intelligence 12 IOCs YARA File information Comments 1

SHA256 hash:	a63dbe18cf6ff766405f06066655fca8fcdf2bfe2a0147006d3d29ef00734fc4
SHA3-384 hash:	9996cdbbcd74c2a2aba22c0ca20113c18861c930d7e769ad86fdb5d65e3a85718ba5f5b160c8d65bcf05d3e7e6bfa1a0
SHA1 hash:	5f61aa02ae5d156878e60fa926d19e67f8448229
MD5 hash:	67e7b84d89ebaeaf5dc946b623cbb3b2
humanhash:	aspen-leopard-nevada-jupiter
File name:	67e7b84d89ebaeaf5dc946b623cbb3b2
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	289'280 bytes
First seen:	2022-04-06 12:36:11 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	5cbd107a7eb6202007731da5377c40ed (3 x Smoke Loader, 2 x Stop)
ssdeep	3072:7JX3bGpZa3rxYM8Xv/qkayY5GUnArfyIURimw3Wp0KtVggjcGkNIVqIpsxkgaBCh:BuaVYM8fifNwBZb3Wp0y7ITsqdiga
Threatray	12'992 similar samples on MalwareBazaar
TLSH	T1F054ADF132928471C0662E30E826CBB12A7F7872D6705517F778772E2E703D19AAE752
File icon (PE):
dhash icon	fcfcb4b4b4d4d9c1 (24 x RedLineStealer, 10 x Smoke Loader, 4 x RaccoonStealer)
Reporter	zbetcheckin
Tags:	32 exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

284

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/261262/

Detection(s):

Win.Dropper.Raccoon-9916366-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Sending an HTTP POST request

Enabling autorun by creating a file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/12831/overview

Behaviour

MeasuringTime

SystemUptime

EvasionGetTickCount

EvasionQueryPerformanceCounter

CheckCmdLine

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware hlux raccoon wacatac

Link:

https://www.filescan.io/uploads/624d897140ce5db9f41aeda6/reports/6f4c70b9-5a32-4aeb-ac77-b3eda35bcd04/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Loki

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e03dcba9-5528-463e-8490-cbe63b3c751f

Result

Threat name:

SmokeLoader Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/971479

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (creates a PE file in dynamic memory)

Found C&C like URL pattern

Found malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Hides threads from debuggers

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

PE file has a writeable .text section

Query firmware table information (likely to detect VMs)

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal browser information (history, passwords, etc)

Yara detected SmokeLoader

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a63dbe18cf6ff766405f06066655fca8fcdf2bfe2a0147006d3d29ef00734fc4/

Threat name:

Win32.Backdoor.Mokes

Status:

Malicious

First seen:

2022-04-06 12:37:08 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 26 (76.92%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uy634ggpn73wmqc7aydgmvp4vd6n6k76fiauoadnhuu66adtj7ca._file

Verdict:

malicious

Smoke Loader

54e3ee54fac434e25c03ded56a4680f1ea40a245d657440ac9c51be7f27ef656

Smoke Loader

687ca5a69fc193e08538b21f8b0aba4a279c75561873b45e71e3ce57721c815b

Smoke Loader

93fc4f2ee5e58547ba2073c5475e846a13f9e98209732bd160f9f5b355b41bca

Smoke Loader

a37cbddb545f168aa1dbb09433e228e5a956f6d8fbc00fae892a5f047990a71f

Smoke Loader

a63b9c4ed6d83aff1bf47215f3297d5fb1cd85e69a24deac6750d511f61de055

Smoke Loader

af94ec40248120d040629b0b921538db88886fb9534a7a167d06d2b6ef5da784

Smoke Loader

ebf3a044246492128aa29dad0c4802f374fe32efb8179da5b9f284dc7e3579a4

Smoke Loader

+ 12'982 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:arkei family:smokeloader botnet:default backdoor discovery evasion spyware stealer suricata trojan

Link:

https://tria.ge/reports/220406-ptf99sfegn/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of NtSetInformationThreadHideFromDebugger

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks whether UAC is enabled

Checks BIOS information in registry

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Downloads MZ/PE file

Executes dropped EXE

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Arkei

SmokeLoader

suricata: ET MALWARE Generic Request to gate.php Dotted-Quad

suricata: ET MALWARE Generic gate .php GET with minimal headers

suricata: ET MALWARE Trojan Generic - POST To gate.php with no accept headers

suricata: ET MALWARE Trojan Generic - POST To gate.php with no referer

Malware Config

C2 Extraction:

http://coralee.at/upload/
http://ducvietcao.com/upload/
http://biz-acc.ru/upload/
http://toimap.com/upload/
http://bbb7d.com/upload/
http://piratia-life.ru/upload/
http://curvreport.com/upload/
http://viagratos.com/upload/
http://mordo.ru/upload/
http://pkodev.net/upload/
http://193.106.191.172/gate.php