MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a92618c221f1a23c122054103b136f6dab994bd7eeb78feb90b5fc627687ce16. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 9

Intelligence 9 IOCs YARA File information Comments

SHA256 hash:	a92618c221f1a23c122054103b136f6dab994bd7eeb78feb90b5fc627687ce16
SHA3-384 hash:	0b6064cece8b42c258c588bf30aaff8c16078ff7108b2a04d805282f31581a8116d4025cef5df44644906d1768885463
SHA1 hash:	32e935835d7d4956f578fddbb44e58fdd2cd3599
MD5 hash:	739ea3e3f504a12e8faaed996d14dd9e
humanhash:	bulldog-helium-moon-montana
File name:	739ea3e3f504a12e8faaed996d14dd9e.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	278'016 bytes
First seen:	2021-08-31 17:05:20 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	d7c1fa8bea76a22199cf71aae838fe49 (3 x RaccoonStealer, 2 x Smoke Loader, 1 x RedLineStealer)
ssdeep	3072:CFshFrmL1scUuJ2ACviEMipCpYJ9dUnjYJe7/8GlLHhSaWI6BOebPoUREj48fgXO:CF0FrmbV2ACqxFYJ9EsKXfvMPlF7
Threatray	3'861 similar samples on MalwareBazaar
TLSH	T163449E22B7A0C037E5B211F49979C3B8A928BDB46B2050FB62D53BDE66346F49C30757
dhash icon	d824e790c4e72158 (30 x RaccoonStealer, 18 x RedLineStealer, 16 x Smoke Loader)
Reporter	abuse_ch
Tags:	Dofoil exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

1'030

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

739ea3e3f504a12e8faaed996d14dd9e.exe

Verdict:

Suspicious activity

Analysis date:

2021-08-31 17:09:34 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/ba8a95a5-639d-4efb-9ad8-355233459ef1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/184268/

Detection(s):

Win.Malware.Generic-9890017-0

Win.Malware.Generic-9890019-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Connection attempt

Sending an HTTP POST request

Sending a UDP request

Creating a process from a recently created file

Sending an HTTP GET request

Creating a file in the %temp% directory

Launching a process

Searching for the window

Searching for analyzing tools

Reading critical registry keys

Sending a custom TCP request

Unauthorized injection to a recently created process

Query of malicious DNS domain

Connection attempt to an infection source

Sending a TCP request to an infection source

Unauthorized injection to a recently created process by context flags manipulation

Deleting of the original file

Enabling autorun by creating a file

Unauthorized injection to a system process

Sending an HTTP POST request to an infection source

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/97c5d92a-a0b6-4765-9f16-9e969f107eaf

Result

Threat name:

Raccoon RedLine SmokeLoader

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/842874

Signature

.NET source code contains method to dynamically call methods (often used by packers)

Antivirus detection for URL or domain

Benign windows process drops PE files

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to inject code into remote processes

Contains functionality to steal Internet Explorer form passwords

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Hides threads from debuggers

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Performs DNS queries to domains with low reputation

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file access)

Writes to foreign memory regions

Yara detected Raccoon Stealer

Yara detected RedLine Stealer

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a92618c221f1a23c122054103b136f6dab994bd7eeb78feb90b5fc627687ce16/

Threat name:

Win32.Trojan.Convagent

Status:

Malicious

First seen:

2021-08-31 15:03:29 UTC

AV detection:

14 of 45 (31.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vetbrqrb6grdyerakqidwe3pnwvzss6x523y724qwx6ge5uhzyla._file

Verdict:

suspicious

Smoke Loader

321b8f87df4dd22bdfc9631a0d84f39b90f16cd8ea0e72f4a1f70df4b39b3468

Smoke Loader

5152274dbe1cc44da156f29d1ff2858e583237bdc24ced137265cd3668ba851e

Smoke Loader

608248c1ef7bab54f8a7aeffaf618187a6f20d3bc829a6c6de625e2a2a376f2b

Smoke Loader

78f958d430a4dec84e4126958d0bde722beab77f03f1ecd733ba94827997dec7

Smoke Loader

8c6e8a02877680a2b503cef0b068b452221f95e68f9131a59421ca95c4339eb2

Smoke Loader

a19317b14abc6d4c1294aaaeab29d0ada023dffa37025c839671c193a74fd519

Smoke Loader

ca12d3f00e654a8c51e15c6eaed8330721e48f398f877fc0ed68a983d3191a37

Smoke Loader

cfcb21c8c129c8c2c525ecfac8bd883260eda6038e3991210765e582007451dd

Smoke Loader

f6a8aa29264495625e7a74ada5f3a792c06c3f9ef472e01c4761bed7d1e4ff96

Smoke Loader

+ 3'851 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:raccoon family:smokeloader botnet:fe582536ec580228180f270f7cb80a867860e010 backdoor discovery evasion spyware stealer themida trojan

Link:

https://tria.ge/reports/210831-cxkx55p4mx/

Behaviour

Checks SCSI registry key(s)

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks whether UAC is enabled

Checks BIOS information in registry

Deletes itself

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Themida packer

Downloads MZ/PE file

Executes dropped EXE

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Raccoon

SmokeLoader

Malware Config

C2 Extraction:

http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/