MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6e56a741e9aa67f861b574964a4999eb77ca586abf079c1891ca09c7900c713. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 16


Intelligence 16 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a6e56a741e9aa67f861b574964a4999eb77ca586abf079c1891ca09c7900c713
SHA3-384 hash: 614fcaf50bd84dc5d4ed9b9a42a5410da0f8a6a2f624e84f215180359d7af0ed1b32fc3a98e2e44a2086a642067d9817
SHA1 hash: a6c37a15d21c5e46f340f0ce61272ab25ce06791
MD5 hash: b0ca83e7ed7944999e052a53911db370
humanhash: ack-fillet-asparagus-alpha
File name:b0ca83e7ed7944999e052a53911db370.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:249'344 bytes
First seen:2023-06-13 10:12:49 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 73d4962fbae1e4c40152701417afb0c7 (2 x GCleaner, 1 x ArkeiStealer, 1 x Smoke Loader)
ssdeep 3072:PEtsNbgXkYUHEMe9cUzvoLkSsxJvZ9P9VMes7u:stsNcXkYGD+WkSsLXPA
Threatray 1'633 similar samples on MalwareBazaar
TLSH T1DA34F913DEA07F64E6354A32AE2EC6F836DEF5108F19776A52289A1F05B00B1C973771
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon 0164646864606810 (1 x Smoke Loader)
Reporter abuse_ch
Tags:Dofoil exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
277
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
smoke
Create hunting rule
ID:
1
File name:
b0ca83e7ed7944999e052a53911db370.exe
Verdict:
Malicious activity
Analysis date:
2023-06-13 10:14:44 UTC
Tags:
loader smoke trojan
Link:
https://app.any.run/tasks/97414003-0aae-4f43-8ceb-12afb565b708

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
SmokeLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/398201/
Detection(s):
Sanesecurity.Malware.29525.BadIN.UNOFFICIAL
Create hunting rule

Win.Packed.Zusy-10003906-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Launching a process
Setting browser functions hooks
Query of malicious DNS domain
Unauthorized injection to a system process
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Unauthorized injection to a browser process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware lolbin packed shell32.dll smokeloader
Link:
https://www.filescan.io/uploads/648841319f45f940f553c200/reports/29b987b2-c0a2-4bb8-b2c0-afda0075ed28/overview
Verdict:
Malicious
Labled as:
Zusy.Generic
Link:
https://www.hybrid-analysis.com/sample/a6e56a741e9aa67f861b574964a4999eb77ca586abf079c1891ca09c7900c713
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/25725f31-f12f-4b10-96b5-f42266ac59fc
Result
Threat name:
SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
bank.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1253501
Signature
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if browser processes are running
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to compare user and computer (likely to detect sandboxes)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Found evasive API chain (may stop execution after checking mutex)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Writes to foreign memory regions
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 886520 Sample: cZLb7ugSmA.exe Startdate: 13/06/2023 Architecture: WINDOWS Score: 100 40 Multi AV Scanner detection for domain / URL 2->40 42 Found malware configuration 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 5 other signatures 2->46 7 cZLb7ugSmA.exe 2->7         started        10 ewjdbbh 2->10         started        process3 signatures4 48 Detected unpacking (changes PE section rights) 7->48 50 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 7->50 52 Maps a DLL or memory area into another process 7->52 54 Creates a thread in another existing process (thread injection) 7->54 12 explorer.exe 1 4 7->12 injected 56 Multi AV Scanner detection for dropped file 10->56 58 Machine Learning detection for dropped file 10->58 60 Checks if the current machine is a virtual machine (disk enumeration) 10->60 process5 dnsIp6 30 stalagmijesarl.com 194.50.153.77, 49722, 49723, 49724 GAZ-IS-ASRU United Kingdom 12->30 32 192.168.2.1 unknown unknown 12->32 26 C:\Users\user\AppData\Roaming\ewjdbbh, PE32 12->26 dropped 28 C:\Users\user\...\ewjdbbh:Zone.Identifier, ASCII 12->28 dropped 62 System process connects to network (likely due to code injection or exploit) 12->62 64 Benign windows process drops PE files 12->64 66 Injects code into the Windows Explorer (explorer.exe) 12->66 68 3 other signatures 12->68 17 explorer.exe 12->17         started        20 explorer.exe 12->20         started        22 explorer.exe 12->22         started        24 6 other processes 12->24 file7 signatures8 process9 signatures10 34 Found evasive API chain (may stop execution after checking mutex) 17->34 36 Checks if browser processes are running 17->36 38 Contains functionality to compare user and computer (likely to detect sandboxes) 17->38
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a6e56a741e9aa67f861b574964a4999eb77ca586abf079c1891ca09c7900c713/
Threat name:
Win32.Trojan.SmokeLoader
Create hunting rule
Status:
Malicious
First seen:
2023-06-13 08:02:00 UTC
File Type:
PE (Exe)
Extracted files:
55
AV detection:
23 of 23 (100.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u3swu5a6tkth7bq3k5ewjjezt23xzjmgvpyhtqmjdsqjy6iay4jq._file
Verdict:
malicious
Similar samples:
08f5ac47b3775e23096ed6113a609fd46971e2f3ffc9d97c7f28a93fa446987c
Smoke Loader
0baa53972ce2be403f9e5d9d3a7f5d7098858a3acd9e16a315f6e4f5e0b2c902
Smoke Loader
253c30cb71da9048557691a67f05e87c83c103c691b27e17674805eb0aa08aed
Smoke Loader
3d4b51afefb80ed6ef1dea05d417da49acfdf2cab7dabcd25038d77891eb0e17
Smoke Loader
41b4cc711899e88e5a7ddc2977d9f817f230e4186841a0d26bd66f26281562b6
Smoke Loader
4dc27dc6049bc102a6dd9ea4c12cc26a31d53655d702ee69a001d794e8008e2e
Smoke Loader
690bddff9a435074fc889707090969fbc214bd95a0b56453f4572528107bf925
Smoke Loader
dc0af5683ce510948ca084132a0fa0eda830021d744a8b8663800df28551babb
Smoke Loader
f26f96e09abbc77ca03bf7c1b884e455eb68f53c02854410ab5904802c92fed1
Smoke Loader
+ 1'623 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader botnet:summ backdoor trojan
Link:
https://tria.ge/reports/230613-l83v2agc3v/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
SmokeLoader
Malware Config
C2 Extraction:
http://stalagmijesarl.com/
http://ukdantist-sarl.com/
http://cpcorprotationltd.com/
Unpacked files
SH256 hash:
48b6a4785f1dc9f33c51c2e588c7f9edf76e551cff8759ac5622cf995330ff14
MD5 hash:
d9cde58139fef6bf75141230f9662d97
SHA1 hash:
68ac6ee1b78dfa15bfe49229640a0929438029af
Detections:
SmokeLoaderStage2
Create hunting rule
win_smokeloader_a2
Create hunting rule
Link:
https://www.unpac.me/results/a7ad4f17-4f1f-4b43-96ed-cb59432ddda4/
Parent samples :
dfa65f33e16205d8c072ba1fb3d0f419f0af2e25f1c251d2b1ef83dd822dc476
aa4938085915798a5b6a03db3a04f6b2927d108db0bfac32ca66462f6a406c36
e4ff3d138daf42cc71613a0b2b9131e672ab42e3fc8f12779efa2f882985c40c
240e33c28d618ba23fc7489c03dcc40e3e3d2c84ef959db800321d1946d3dbcf
65640ae45f81e5a0367d374193b9a7958e7e2cba9b4f7e448cd2545a70c2880e
b78d66de4f94fd68a2fa5181f8b2a865d43f44fba0efbff7dd3a8215ce153891
b2c3517bb90933390df4eb01c6ba36f2a519a69b5bcee703f4889b8336cb7027
5ecd711693f12b243e84e97975eaf2f981016a7cf004841dceb7b9d720bc1f6d
a6e56a741e9aa67f861b574964a4999eb77ca586abf079c1891ca09c7900c713
2f526d3756e8f59616b5f69c9527d4751594ea82464c971eaadfc04216d0b27a
14a81d39c1a2260f7dde336245ab276a3416319e8bea2740107f8da6b5baecc2
57058dda63d287fb506d12c043fe1eb07abcaacb703fb2f8120edefb815bd1a8
9e4e8a3c08c71e24a113731d9b3c6221c79a0d82e9ab0b510e4240257b4d0eee
954a8d78e97e2bb65568d4c5d692a2a9975a330eaa7fae20e4620d18ccbb5881
bfe83b5436233b54ba7808d535042708313d5ec62aece600d943798f5c62efda
fc5c1ed9df3db079ed9b1714c11b5fd8edd6f69498fe6150303ae160884d3c04
e59ad322f3178a7905a9a3c623e7b5d8132080ddc9d2d3797d64939a23611a00
e93e6d9ed58c2476607f4352c2fb03b5247276f5be99840b0db4d546457f20e5
c862c9ce5cc849f7e292a61984c11b3a61a137f71ce19b3e72b653932602a0fc
8c3f095428d5283ec57391611e24689e88aa93e0a6868d6994d2e26761740ce3
455cd1baccbf9b3abc59454a6d80ee72c2db5cb6ffb73a5102b5a1e6eb78599e
45395f6fad7289cb0f9599ed1f578140d5280f1769957c4bba4fb5f6798a41bf
d347eea452c0cd8f233db473bc2889ef05049a6bffef49184120c9d302fa74e6
cb5834ff88fd8e818ddd26ae5e6a080be8b5e17ee4238df66080175a5cf802eb
2f114f5d0e6063b5c3c3276bdbd20766a102b49dd48dce74d142eefa07c7cda5
eeb18dec0f9402e96fb629ab201890d8b2fcfeb45e890e42e3a79a799e575771
26ee5ecb55714d302e8adcc345fc373abf5eb3189c854922cfca7c3c5c7018fe
ef04fe325737cad04ca603cf3a72a71b86bc51786b696972e243cbd0612538b1
e58ebdf4702cc16c7b5626d7e5a169fda32ecb3df251c9f087c8ad7ad6897672
799c6f0780b063a98ca67e217ac920733e5ed59742300658a747457ef30a3ed8
a5cb5558a1fb53b177fd0a683da3e93c4c0149588c7b06b5b8f5570896bd79bc
5b6d6c1bf6cfc3f0c4b792a2416d52588c22701fc9484c7c0a40bfb75ced4c4e
fc70465d07b9f3eb64e7f5ada2c047cd54b1a10b2790264456c0f76a798b50fc
fd831bc88d1c08c8b8a2e3756569b8fc3c143d516f4a72ec6fbf3c456c6209bb
2cc7483f686c00278ce3dcda694baca322bfbe70e8cf4ec5dd8ec0f31a955625
c17336d7c543eef6427833e8a3f419dd02c7cd2fd7665725732c35e61a354f2c
2c43ca2ea57631cdd00d46b6d292ca82922c239c1ad400a4714134fed8f2a50e
4f2680a213e3345c83f3f0adc9bcf75af76e50eed035b2c54f54b071e115f694
b2f12a3ef735f92b67cf807fb8be7df8400c065318ad3b0f8cd144738db7b96b
SH256 hash:
a6e56a741e9aa67f861b574964a4999eb77ca586abf079c1891ca09c7900c713
MD5 hash:
b0ca83e7ed7944999e052a53911db370
SHA1 hash:
a6c37a15d21c5e46f340f0ce61272ab25ce06791
Link:
https://www.unpac.me/results/a7ad4f17-4f1f-4b43-96ed-cb59432ddda4/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a6e56a741e9a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a6e56a741e9aa67f861b574964a4999eb77ca586abf079c1891ca09c7900c713

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/398201/

Comments