MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b010a749d181fa2a1ad4bf78d84043a1fa334900029b86947a11990a6cb1db3e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 16


Intelligence 16 IOCs YARA 1 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b010a749d181fa2a1ad4bf78d84043a1fa334900029b86947a11990a6cb1db3e
SHA3-384 hash: 57c6b1a7c5ff389788ac45fa242df2a25e3b32688fd1c73a8984be908751d0b54bb02b852398b234812f8d86976eb13e
SHA1 hash: f3ae890337b5f8db7404bd498c94b53e7d19884a
MD5 hash: 63b1cbf876981da8cb5477a773e75c98
humanhash: solar-kitten-asparagus-saturn
File name:63b1cbf876981da8cb5477a773e75c98
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:306'688 bytes
First seen:2023-06-20 09:32:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b1a5bdbc77a4868d9509a53571fbe8fe (3 x Smoke Loader, 2 x RedLineStealer, 1 x GCleaner)
ssdeep 3072:nDzdpY8ZLDD/TuXSzzHuYCoIfaWgxAdIbg6hzamRLcLZ+t:DBC8BDD70Czbv9xl4
Threatray 4'247 similar samples on MalwareBazaar
TLSH T14964858382E13D94F9278B73AE1FD6E8764DF6608F497B692218DA1F04B11B6C1B3750
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon c420408080a48488 (1 x Smoke Loader)
Reporter zbetcheckin
Tags:32 exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
295
Origin country :
FR FR
Vendor Threat Intelligence
Malware family:
smoke
Create hunting rule
ID:
1
File name:
63b1cbf876981da8cb5477a773e75c98
Verdict:
Malicious activity
Analysis date:
2023-06-20 09:32:30 UTC
Tags:
loader smoke trojan stealer
Link:
https://app.any.run/tasks/22b065fb-02ff-47b1-9fdc-e1a9fde26366

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
SmokeLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/400948/
Detection(s):
Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Sending an HTTP POST request
Launching a process
Reading critical registry keys
Creating a file in the %temp% directory
Сreating synchronization primitives
Setting browser functions hooks
Unauthorized injection to a system process
Stealing user critical data
Enabling autorun by creating a file
Unauthorized injection to a browser process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/649172188c599a59135e1460/reports/0a09e3e2-1dd5-4188-ba83-ef819942e6ea/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/b010a749d181fa2a1ad4bf78d84043a1fa334900029b86947a11990a6cb1db3e
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Malicious Packer
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3cf00587-795f-4620-bb72-11e8eff754cc
Result
Threat name:
SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
bank.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1258093
Signature
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if browser processes are running
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to compare user and computer (likely to detect sandboxes)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Found evasive API chain (may stop execution after checking mutex)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 891113 Sample: CT3Ed4joyb.exe Startdate: 20/06/2023 Architecture: WINDOWS Score: 100 40 Found malware configuration 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 4 other signatures 2->46 7 CT3Ed4joyb.exe 2->7         started        10 ugitgie 2->10         started        process3 signatures4 48 Detected unpacking (changes PE section rights) 7->48 50 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 7->50 52 Maps a DLL or memory area into another process 7->52 54 Creates a thread in another existing process (thread injection) 7->54 12 explorer.exe 3 4 7->12 injected 56 Multi AV Scanner detection for dropped file 10->56 58 Machine Learning detection for dropped file 10->58 60 Checks if the current machine is a virtual machine (disk enumeration) 10->60 process5 dnsIp6 30 suprememax.ga 185.173.39.106, 49694, 80 ECO-ASRU Russian Federation 12->30 26 C:\Users\user\AppData\Roaming\ugitgie, PE32 12->26 dropped 28 C:\Users\user\...\ugitgie:Zone.Identifier, ASCII 12->28 dropped 62 System process connects to network (likely due to code injection or exploit) 12->62 64 Benign windows process drops PE files 12->64 66 Injects code into the Windows Explorer (explorer.exe) 12->66 68 3 other signatures 12->68 17 explorer.exe 6 12->17         started        20 explorer.exe 12->20         started        22 explorer.exe 12->22         started        24 4 other processes 12->24 file7 signatures8 process9 signatures10 32 Found evasive API chain (may stop execution after checking mutex) 17->32 34 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 17->34 36 Tries to steal Mail credentials (via file / registry access) 17->36 38 3 other signatures 17->38
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b010a749d181fa2a1ad4bf78d84043a1fa334900029b86947a11990a6cb1db3e/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-06-20 09:33:05 UTC
File Type:
PE (Exe)
Extracted files:
74
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=waikosorqh5cugwux54nqqcduh5dgsiaaknynfd2cgmqu3fr3m7a._file
Verdict:
malicious
Similar samples:
0ab54468721453d7237df27d4dd6383366edb5cc3bfab9a20d48a2416ca2aed8
Smoke Loader
1171766b3c8e74122333aedfcf8ff32bcd2e059043af434dc57a70b6015b3e63
Smoke Loader
59a9abae3f724f1ff212766b64ab691d34cd0624337204caa65406a1378329a3
Smoke Loader
7f02d0bb42962b382ef7d6f5c3d647fa199311a586b5f0fd6c5e266759211967
Smoke Loader
8113159e0ac7c44fb49f3231ea9541e2d9ce9fd06dee9887037349e3370e6e73
Smoke Loader
84c63d7b5b76b8069dec9760aa1bb530b062889cfce4f2fa82e5288cb82b25fa
Smoke Loader
a5e2e1d4ae2ea2f1de7b448222962195698a6e82a0f890d5e2898f5b28d7b6f0
Smoke Loader
d896e1c6f1124eb8cf19f29d2dec8d35203cfd4ea36636549e178a1a06de10db
Smoke Loader
e3c15f1c7b655b44882792cbb98fd962f47137dea2621128be6595a1237a2672
Smoke Loader
+ 4'237 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor collection trojan
Link:
https://tria.ge/reports/230620-lhncnabb72/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
outlook_office_path
outlook_win_path
Accesses Microsoft Outlook profiles
SmokeLoader
Malware Config
C2 Extraction:
http://suprememax.ga/
http://bloomberg.ga/
Unpacked files
SH256 hash:
0d1951f30938c16071c93a0b4c1081245b94236181012e93faad06fdcf3838dc
MD5 hash:
ee0e4eff207e538c0a67848818d89cfd
SHA1 hash:
af73c67b37e5a4265988b7b368cf5b18d3328746
Detections:
SmokeLoaderStage2
Create hunting rule
win_smokeloader_a2
Create hunting rule
Link:
https://www.unpac.me/results/a34ca90e-07b3-430a-8207-df5058e381c2/
Parent samples :
2c4cefea32bcd7a2b3fce9441b265f7c4aa36a7dc54ddf4964a6b799266760cf
8113159e0ac7c44fb49f3231ea9541e2d9ce9fd06dee9887037349e3370e6e73
d896e1c6f1124eb8cf19f29d2dec8d35203cfd4ea36636549e178a1a06de10db
57c2cea33c310ad66d76c408ba1437f59f2172e77a96f353f568fa9ec8854a35
b010a749d181fa2a1ad4bf78d84043a1fa334900029b86947a11990a6cb1db3e
4fce1d0099d746c09f6e7a8ae41882cbb95070ab24843b1516b8a74ce65d3701
9e6ce673dc161fc54b110782f18ec9bb3690b9ccdde494196ccb5bb0381dfa94
SH256 hash:
b010a749d181fa2a1ad4bf78d84043a1fa334900029b86947a11990a6cb1db3e
MD5 hash:
63b1cbf876981da8cb5477a773e75c98
SHA1 hash:
f3ae890337b5f8db7404bd498c94b53e7d19884a
Link:
https://www.unpac.me/results/a34ca90e-07b3-430a-8207-df5058e381c2/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b010a749d181/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b010a749d181fa2a1ad4bf78d84043a1fa334900029b86947a11990a6cb1db3e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Windows_Trojan_Smokeloader_3687686f
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe b010a749d181fa2a1ad4bf78d84043a1fa334900029b86947a11990a6cb1db3e

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/2665972/
Cape
Cape
https://www.capesandbox.com/analysis/400948/

Comments


Avatar
zbet commented on 2023-06-20 09:32:03 UTC

url : hxxp://192.3.101.139/255/dahosts.exe