MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6990e669667f67449c6b4daf0a90327ffd14bb03137c4895296a0a9642acbae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	a6990e669667f67449c6b4daf0a90327ffd14bb03137c4895296a0a9642acbae
SHA3-384 hash:	53d09d848a89f238615ed7d7df4b1e6f4705a4d63f8dbbe1d91fce3969eb6684e3f6beac4b66503b17f0a483d1bc219f
SHA1 hash:	c2a3cf776c022de721a9a92f90cb08b0fe5c5df4
MD5 hash:	b999333b4c66486b595c6ddf2ca571d4
humanhash:	ceiling-nineteen-north-undress
File name:	b999333b4c66486b595c6ddf2ca571d4.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	359'936 bytes
First seen:	2020-11-11 08:09:07 UTC
Last seen:	2020-11-11 09:47:15 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	957f451a9a7944a1fbdb8d7ab72b6645 (5 x Smoke Loader)
ssdeep	6144:tTweV+IYpa2LgXFGR+595JtWQzJ7P9iw0c53:hdV+pa2+FGk59FB10
TLSH	7874AE11B1D1C0F1D5A6027844A5D3A0DABBB8751774CAFB2B9027AE1F763E29A3D343
Reporter	abuse_ch
Tags:	exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

PUA.Win.Downloader.Firseria-6804617-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Sending a UDP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Sending an HTTP POST request

Sending a custom TCP request

Creating a process from a recently created file

Launching a process

Creating a window

Searching for the window

Reading critical registry keys

Sending an HTTP GET request

Setting browser functions hooks

Unauthorized injection to a system process

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Deleting of the original file

Enabling autorun by creating a file

Unauthorized injection to a browser process

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

CobaltStrike SmokeLoader

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/529968

Signature

Benign windows process drops PE files

Binary contains a suspicious time stamp

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (creates a PE file in dynamic memory)

Detected unpacking (overwrites its own PE header)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Renames NTDLL to bypass HIPS

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Writes to foreign memory regions

Yara detected CobaltStrike

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a6990e669667f67449c6b4daf0a90327ffd14bb03137c4895296a0a9642acbae/

Threat name:

Win32.Trojan.Glupteba

Status:

Malicious

First seen:

2020-11-11 08:10:06 UTC

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor spyware trojan

Link:

https://tria.ge/reports/201111-45qcbqzrw2/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of UnmapMainImage

Program crash

Suspicious use of SetThreadContext

Deletes itself

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

SmokeLoader

Malware Config

C2 Extraction:

http://smk10ddde.com/

Unpacked files

SH256 hash:

a6990e669667f67449c6b4daf0a90327ffd14bb03137c4895296a0a9642acbae

MD5 hash:

b999333b4c66486b595c6ddf2ca571d4

SHA1 hash:

c2a3cf776c022de721a9a92f90cb08b0fe5c5df4

Link:

https://www.unpac.me/results/48a0175e-73b4-4c1e-a8a4-da6ef549dc68/

SH256 hash:

640326eaa9b6d1eebecf4925208ea87f31574b530e81b25575a5ab28f23ba90d

MD5 hash:

701f9a4e569369f69ec1c8d2114f5c09

SHA1 hash:

1964037544e248c943177d19b105e3e5594ca53f

Link:

https://www.unpac.me/results/48a0175e-73b4-4c1e-a8a4-da6ef549dc68/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.