MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 acc17deb417db03958118c1ac08156e0fca081605b909644523dd3fa887cf674. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 18

Intelligence 18 IOCs YARA 4 File information Comments

SHA256 hash:	acc17deb417db03958118c1ac08156e0fca081605b909644523dd3fa887cf674
SHA3-384 hash:	0cafe2be9da62b6dd7ec9c4106fb25197db2adba6e65c2f1fb70d3c3c660292da2efb1b5228f1a0d0c3bea71f8630066
SHA1 hash:	14d41b08cc0608ad1f455174f58a281f44171514
MD5 hash:	655a5965f6358d8391e18cff5e600815
humanhash:	foxtrot-cola-one-december
File name:	655a5965f6358d8391e18cff5e600815.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	212'992 bytes
First seen:	2024-08-22 07:16:06 UTC
Last seen:	2024-08-22 08:26:10 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f80fbd9dd32e5951bbad86b5e5729f17 (1 x Smoke Loader)
ssdeep	1536:FHsTyQCmnQdNTTA8svX5jsWaH2e5M6KvApxLeBFAr9PfN0911LT2BkWq45oOxe2g:FH7vdTAvXBYrMr/QVqBDWh5oWeLO6tM
TLSH	T13C249E2236E39076DFFB4A7098B4DBA41ABBF8672631414F26A6375E5E313C08671317
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):
dhash icon	9671e896ccd2d4cc (4 x Smoke Loader, 2 x GCleaner, 1 x MarsStealer)
Reporter	abuse_ch
Tags:	exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

412

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

655a5965f6358d8391e18cff5e600815.exe

Verdict:

Malicious activity

Analysis date:

2024-08-22 07:29:27 UTC

Tags:

loader smokeloader

Link:

https://app.any.run/tasks/6aa4b42c-0861-42b9-b272-36a7c96943ad

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win32.CrypterX-gen.6975.10544.UNOFFICIAL

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66c6e5f1e7ff3f5a063bbe58

Tags:

Network Stealth Smoke Loader

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Connection attempt

Sending an HTTP POST request

Unauthorized injection to a system process

Enabling autorun by creating a file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

anti-vm epmicrosoft_visual_cc fingerprint microsoft_visual_cc smokeloader

Link:

https://www.filescan.io/uploads/66c6e5f209d7a6ae9287f5fe/reports/6b259336-a5f7-4ab0-b304-b6817e311bc1/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/acc17deb417db03958118c1ac08156e0fca081605b909644523dd3fa887cf674

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/e673ad9c-075a-43c1-8cca-57b2290b18aa

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1497249

Signature

AI detected suspicious sample

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

System process connects to network (likely due to code injection or exploit)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/acc17deb417db03958118c1ac08156e0fca081605b909644523dd3fa887cf674

Detection:

smokeloader

Link:

https://mwdb.cert.pl/sample/acc17deb417db03958118c1ac08156e0fca081605b909644523dd3fa887cf674/

Threat name:

Win32.Trojan.SmokeLoader

Status:

Malicious

First seen:

2024-08-22 03:27:32 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

31 of 38 (81.58%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vtax322bpwydswarrqnmbakw4d6kbalaloijmrcshxj7vcd46z2a._file

Verdict:

malicious

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader botnet:pub2 backdoor discovery trojan

Link:

https://tria.ge/reports/240822-h4dhssxgpr/

Behaviour

Checks SCSI registry key(s)

Program crash

System Location Discovery: System Language Discovery

SmokeLoader

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/4e5bc1d6-6ddb-41d8-abcf-21791bfc2c9a

Unpacked files

SH256 hash:

977646f31a879d2ddd9938e2f39a74653556fd970dd2fa6172f26348d18622dc

MD5 hash:

8ee858716125555e7355a2b919417a53

SHA1 hash:

20a3bfa728fe21f18f6c4f8c17c01e4bd416063e

Detections:

SmokeLoaderStage2

win_smokeloader_a2

Link:

https://www.unpac.me/results/5b3a74de-a2de-445a-93a3-772da1581a19/

Parent samples :

3ec76b58400fa83602d35d82f38341d921223dcdf175b98bca435a59ba340464
d3e138b03be305d34d6ee21c5f4cc4d496ff447601ffb71508e23e580bd50e7c
edf20ee240507ae1f49a20f8d20deee11484c013150d6d57ae1fe8ff69e0f8d5
e75102f75f478c346b1dd2ebd56311a9d7345d3c785a6b2dc2911033a317c485
d1abb50ea4d533a3e57b99e347d5d8675896ce23576987edcc9c3426ffb0c380
acc17deb417db03958118c1ac08156e0fca081605b909644523dd3fa887cf674
88b5ed74d4fc6f2cf6394bd1766f44df61e7dc9b810cfacbecba5b34af3bf57d
76ba1d82e20b13b9d1becbb799aa68f6539092f6823f38a86ce935b0650b0556
41582c8b6bd111a2f141dee52b619d13278ef68754691263abeb3238d485f404
1c1d81eaf1a389d4dafc6ba71a3e3bfaa477a49b4d3591956cab660165648028
1415378411d7d155dd8217cdc7e453dc221219b2432473d110ea65368f58f095

SH256 hash:

acc17deb417db03958118c1ac08156e0fca081605b909644523dd3fa887cf674

MD5 hash:

655a5965f6358d8391e18cff5e600815

SHA1 hash:

14d41b08cc0608ad1f455174f58a281f44171514

Link:

https://www.unpac.me/results/5b3a74de-a2de-445a-93a3-772da1581a19/

Malware family:

SmokeLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/acc17deb417d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/acc17deb417db03958118c1ac08156e0fca081605b909644523dd3fa887cf674

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

exe acc17deb417db03958118c1ac08156e0fca081605b909644523dd3fa887cf674

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3112840/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetStartupInfoA KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::FillConsoleOutputCharacterA KERNEL32.dll::WriteConsoleOutputA KERNEL32.dll::SetConsoleScreenBufferSize KERNEL32.dll::GetConsoleAliasesLengthW KERNEL32.dll::GetConsoleAliasesLengthA
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateDirectoryW
WIN_BASE_USER_API	Retrieves Account Information	KERNEL32.dll::GetComputerNameA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample