MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af94ec40248120d040629b0b921538db88886fb9534a7a167d06d2b6ef5da784. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 10

Intelligence 10 IOCs YARA File information Comments

SHA256 hash:	af94ec40248120d040629b0b921538db88886fb9534a7a167d06d2b6ef5da784
SHA3-384 hash:	89714d65c7178b74a75d430ad5b23306e0aa0aba20678484618cefd31a2cc5c58c10c256954a50d623751de9d56f30b7
SHA1 hash:	50a3ef6ccecdafc425af23a89cb8d8864ac6fbeb
MD5 hash:	93639f8862890df00b4d1a80d0d57ae6
humanhash:	seven-summer-oklahoma-missouri
File name:	93639f8862890df00b4d1a80d0d57ae6.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	236'544 bytes
First seen:	2022-03-27 17:08:07 UTC
Last seen:	2022-03-27 17:45:04 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	a945bbba5e19a9f29aa1458bdc91ed8a (6 x Smoke Loader, 6 x SystemBC, 5 x Worm.Ramnit)
ssdeep	3072:jC9tVNVHcEajP9MQn0cw5xG5bfg/RzoF:jWjNzajP9rn0cw5xwf8RU
Threatray	13'357 similar samples on MalwareBazaar
TLSH	T1AC34E1113281E071C44B953578E0CBB16E6EAC3253A6598B3BAD1BBD2F303D15BB935B
File icon (PE):
dhash icon	5c59da3ce0c3c850 (12 x Stop, 11 x RedLineStealer, 8 x Smoke Loader)
Reporter	abuse_ch
Tags:	exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

199

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/258187/

Detection(s):

SecuriteInfo.com.Trojan.DownLoader44.47781.13589.22245.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a custom TCP request

Sending an HTTP GET request

Searching for the window

Сreating synchronization primitives

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Sending an HTTP POST request

Unauthorized injection to a system process

Enabling autorun by creating a file

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

anti-vm greyware

Link:

https://www.filescan.io/uploads/62409a2e9253b276b785e2b8/reports/d82f4db3-cbda-4cca-8a54-d30b9da24d4f/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

STOP Ransomware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/254132b2-2bad-4689-b26b-d5932c3bc4c5

Result

Threat name:

RedLine SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/965321

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code references suspicious native API functions

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to evade debugger and weak emulator (self modifying code)

Yara detected RedLine Stealer

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/af94ec40248120d040629b0b921538db88886fb9534a7a167d06d2b6ef5da784/

Threat name:

Win32.Trojan.Raccrypt

Status:

Malicious

First seen:

2022-03-27 06:42:50 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 26 (80.77%)

Threat level:

5/5

Verdict:

malicious

Smoke Loader

54e3ee54fac434e25c03ded56a4680f1ea40a245d657440ac9c51be7f27ef656

Smoke Loader

5aecb2a5bc5447dc736c29882193fef4f2b007299a1817c664e1ba6a028363cf

Smoke Loader

998d503aa5e68830d7f981490108d44dc12f331bd5ad9ea9f207a99e6d06afbb

Smoke Loader

a37cbddb545f168aa1dbb09433e228e5a956f6d8fbc00fae892a5f047990a71f

Smoke Loader

a63b9c4ed6d83aff1bf47215f3297d5fb1cd85e69a24deac6750d511f61de055

Smoke Loader

a9c469cba54a8d8de70bfb591dd9899333c535fde1537176b12e9c05945ef453

Smoke Loader

+ 13'347 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor trojan

Link:

https://tria.ge/reports/220327-vn4q9sfaem/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Program crash

Deletes itself

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

SmokeLoader

Malware Config

C2 Extraction:

http://coralee.at/upload/
http://ducvietcao.com/upload/
http://biz-acc.ru/upload/
http://toimap.com/upload/
http://bbb7d.com/upload/
http://piratia-life.ru/upload/
http://curvreport.com/upload/
http://viagratos.com/upload/
http://mordo.ru/upload/
http://pkodev.net/upload/