MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ae943d0a626dca424ec19cd0f7bf24560943e93e309c5c167dcb15e67f3099d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ae943d0a626dca424ec19cd0f7bf24560943e93e309c5c167dcb15e67f3099d5
SHA3-384 hash: 616d17720f3bb78296955c11885bcb8ad3d83f9a7a3ace050b48559ad37c8b928519be485e85ab24c5af9f5388bde0c6
SHA1 hash: c688cde0db543e73e7ebe2f28b4e527cd2606aca
MD5 hash: fa46d6d2450b9eafbb66846701d48571
humanhash: mike-wolfram-lithium-fish
File name:fa46d6d2450b9eafbb66846701d48571.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:228'864 bytes
First seen:2022-04-08 09:48:00 UTC
Last seen:2022-04-08 11:11:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 33f654ee7835845e395c50475d4ae5e3 (4 x RedLineStealer, 4 x ArkeiStealer, 2 x Loki)
ssdeep 1536:5SQukcsVBV+5j67nJCs1yPsT0lg9xmlHkCnIO2rQohlpgg1FHKPsgwZd2RCArKy:5SXuV8WqCmJ2rQohlqOFHKPsHIX5
Threatray 15'835 similar samples on MalwareBazaar
TLSH T12B24BE123382D8B1D097563068B5CAA12A7BBC726775445FB7B83B3E2E703C16AF5352
File icon (PE):PE icon
dhash icon f8f8b5b4b494d9c1 (1 x Smoke Loader)
Reporter abuse_ch
Tags:Dofoil exe Smoke Loader

Intelligence

File Origin
# of uploads :
2
# of downloads :
407
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
fa46d6d2450b9eafbb66846701d48571.exe
Verdict:
Suspicious activity
Analysis date:
2022-04-08 10:10:34 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/5eb01ee0-ebf7-43a6-b942-1a229797a43b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/262065/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.17415.65.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Sending an HTTP POST request
Enabling autorun by creating a file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/13145/overview
Behaviour
MeasuringTime
SystemUptime
EvasionGetTickCount
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/625004eccccdcb99472a1628/reports/e39a7868-1fb1-40ce-b446-53edcd08a9a5/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Loki
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a67fcb37-708d-406d-aea7-f4af67fa9106
Result
Threat name:
SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/973022
Signature
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 605509 Sample: sEMl7tCJ87.exe Startdate: 08/04/2022 Architecture: WINDOWS Score: 100 27 coralee.at 2->27 41 Multi AV Scanner detection for domain / URL 2->41 43 Found malware configuration 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 6 other signatures 2->47 8 sEMl7tCJ87.exe 2->8         started        11 rsjrrtd 2->11         started        signatures3 process4 signatures5 49 Detected unpacking (changes PE section rights) 8->49 51 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 8->51 53 Maps a DLL or memory area into another process 8->53 13 explorer.exe 2 8->13 injected 55 Machine Learning detection for dropped file 11->55 57 Checks if the current machine is a virtual machine (disk enumeration) 11->57 59 Creates a thread in another existing process (thread injection) 11->59 process6 dnsIp7 29 coralee.at 186.182.55.44, 49725, 49727, 49732 TechtelLMDSComunicacionesInteractivasSAAR Argentina 13->29 31 194.5.212.120, 80 METROSERV-ASRO Romania 13->31 33 5 other IPs or domains 13->33 21 C:\Users\user\AppData\Roaming\rsjrrtd, PE32 13->21 dropped 23 C:\Users\user\AppData\Local\Temp\714C.exe, PE32 13->23 dropped 25 C:\Users\user\...\rsjrrtd:Zone.Identifier, ASCII 13->25 dropped 61 System process connects to network (likely due to code injection or exploit) 13->61 63 Benign windows process drops PE files 13->63 65 Deletes itself after installation 13->65 67 Hides that the sample has been downloaded from the Internet (zone.identifier) 13->67 18 714C.exe 13->18         started        file8 signatures9 process10 signatures11 35 Detected unpacking (changes PE section rights) 18->35 37 Detected unpacking (overwrites its own PE header) 18->37 39 Machine Learning detection for dropped file 18->39
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ae943d0a626dca424ec19cd0f7bf24560943e93e309c5c167dcb15e67f3099d5/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2022-04-08 09:48:14 UTC
File Type:
PE (Exe)
Extracted files:
18
AV detection:
29 of 42 (69.05%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=v2kd2ctcnxfeetwbttipppzekyeuh2j6gcofyft5zmk6m7zqthkq._file
Verdict:
malicious
Similar samples:
313c8bb887567806112d0755963632c1b6f66d9479965efae7ce39cd4738bc1a
Smoke Loader
6556b141cb6d777870608bcdcccf2851e4707edccbe14793bdc81b01f5d0819d
Smoke Loader
687ca5a69fc193e08538b21f8b0aba4a279c75561873b45e71e3ce57721c815b
Smoke Loader
a37cbddb545f168aa1dbb09433e228e5a956f6d8fbc00fae892a5f047990a71f
Smoke Loader
a63dbe18cf6ff766405f06066655fca8fcdf2bfe2a0147006d3d29ef00734fc4
Smoke Loader
dc6fd62fa75a3d7028b8838a56b95d7cf1c05bdd6987ef46a41ae379f944bfff
Smoke Loader
+ 15'825 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor trojan
Link:
https://tria.ge/reports/220408-lssecsggcp/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Program crash
Deletes itself
Loads dropped DLL
Downloads MZ/PE file
Executes dropped EXE
SmokeLoader
Malware Config
C2 Extraction:
http://coralee.at/upload/
http://ducvietcao.com/upload/
http://biz-acc.ru/upload/
http://toimap.com/upload/
http://bbb7d.com/upload/
http://piratia-life.ru/upload/
http://curvreport.com/upload/
http://viagratos.com/upload/
http://mordo.ru/upload/
http://pkodev.net/upload/
https://oakland-studio.video/search.php
https://seattle-university.video/search.php
Unpacked files
SH256 hash:
62ca52b62339a8f96855c150d8d9cb0aca0ba998200111e8a44aaf399c3fdcab
MD5 hash:
d51a93b9ad236dc9b151c9f02fdbb646
SHA1 hash:
8865942793663d04bc55246c158cc5d96e8efdb8
Link:
https://www.unpac.me/results/097e6f17-c7eb-40d7-9d52-c3d23e493368/
Parent samples :
d372df2f0b72e4bde91c57cb6c5cdd6f39486c68cb5cd26fa3aaf6a403bc0b66
b12d171c3a13bd3e9ded2a8c6c6c3a9303610df03ba52fa274f7f75a04b66efa
d3366535f78da4fa4b13d134260a27cad97a30c7b2de25387158077ba29b394f
35d7e3bb4439ad5252c87cbe81d7626aa72accd719ff4af346964b74ac34a689
16267071c251784aeebe5d562dfd58bfbc0a0767a85ebc5863025bc74a69d339
SH256 hash:
ae943d0a626dca424ec19cd0f7bf24560943e93e309c5c167dcb15e67f3099d5
MD5 hash:
fa46d6d2450b9eafbb66846701d48571
SHA1 hash:
c688cde0db543e73e7ebe2f28b4e527cd2606aca
Link:
https://www.unpac.me/results/097e6f17-c7eb-40d7-9d52-c3d23e493368/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/ae943d0a626d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ae943d0a626dca424ec19cd0f7bf24560943e93e309c5c167dcb15e67f3099d5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe ae943d0a626dca424ec19cd0f7bf24560943e93e309c5c167dcb15e67f3099d5

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2134164/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/262065/

Comments