MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5f6dd8ed8b59d1928f750db19e5c04d74892c9890eeff8d9805ef2f7152411e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 8

Intelligence 8 IOCs YARA File information Comments 1

SHA256 hash:	b5f6dd8ed8b59d1928f750db19e5c04d74892c9890eeff8d9805ef2f7152411e
SHA3-384 hash:	d9ae70f3d09ea3da0e58452b2fe46006aa11cd7de90c18ed30901395d32400723c9ae0c3ec9ba11085fe64153ce2e086
SHA1 hash:	8e86b2dc11ff92ba81741260f9db701f596984cf
MD5 hash:	a78d99f318fe55b829e1f44b4975d5e2
humanhash:	wolfram-charlie-finch-carolina
File name:	a78d99f318fe55b829e1f44b4975d5e2
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	219'136 bytes
First seen:	2021-07-23 19:06:11 UTC
Last seen:	2021-07-23 21:43:24 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	d09a478840961ad890ac4dc4d59be69d (10 x Smoke Loader, 4 x RaccoonStealer, 2 x RedLineStealer)
ssdeep	3072:gAlBfMWke/2mnTzBuzRQHI0T2Lp70BPuxaWC8C:gafMpMb5oC2WBPAn
Threatray	3'432 similar samples on MalwareBazaar
TLSH	T1AF24BE30FAB0C872D0A5097058EAC6A46A2DBC36BA20DD0777573B5F2F312D1667921F
dhash icon	4839b2b0e8c38c90 (11 x RedLineStealer, 10 x RaccoonStealer, 2 x Smoke Loader)
Reporter	zbetcheckin
Tags:	32 exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

154

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

a78d99f318fe55b829e1f44b4975d5e2

Verdict:

Suspicious activity

Analysis date:

2021-07-23 19:09:28 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/5ebf92a5-1bf7-4fb2-bade-df412aad3a03

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Raccoon

Link:

https://www.capesandbox.com/analysis/173769/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware1.6761.27694.UNOFFICIAL

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

SmokeLoader

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/300967fe-0a89-4f34-a635-0536c44a330c

Result

Threat name:

Raccoon RedLine SmokeLoader Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/821023

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code contains very large array initializations

.NET source code contains very large strings

.NET source code references suspicious native API functions

Benign windows process drops PE files

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to steal Internet Explorer form passwords

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Sample uses process hollowing technique

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to resolve many domain names, but no domain seems valid

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file access)

Uses known network protocols on non-standard ports

Writes to foreign memory regions

Yara detected Raccoon Stealer

Yara detected RedLine Stealer

Yara detected SmokeLoader

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b5f6dd8ed8b59d1928f750db19e5c04d74892c9890eeff8d9805ef2f7152411e/

Threat name:

Win32.Packed.Generic

Status:

Suspicious

First seen:

2021-07-23 19:07:05 UTC

AV detection:

19 of 46 (41.30%)

Threat level:

1/5

Verdict:

suspicious

Smoke Loader

201f2b8cd0d15399da2d0b98ff9b7d50d515deeea3f9435062b4b0a4548b0082

Smoke Loader

8567ac320d50d1a5ea18ffe81f2d4e9a7255e3df0ac69fd98df890108586f60f

Smoke Loader

948bae9510601455f2ba50d694a6561bf2e85071b86161a0186672616ae17a77

Smoke Loader

98748a03aeda89cd33105254527ba92b2f7d070b794c648f2e7c823f68030809

Smoke Loader

a0b246bae327f318bf41f1920cffadfab1ee2e49625b6b360a7c999c55053ee6

Smoke Loader

d6206c05051cd22da3912b1d30df468f0c0571b4b34a8fe2c912f82ff05a8e6a

Smoke Loader

fa1409fe184c11483708f197504246fb15ae88942e1b18a9266e0d0f4dca8290

Smoke Loader

fa49ec9a6afac3db69d66e560157aee92bfffa30c24d2a7855a4d3bcf2d894e2

Smoke Loader

fc5f8356ee7ba0be1f0f4c24ac4944481759352d665bbc1208295d39cd3da30f

Smoke Loader

+ 3'422 additional samples on MalwareBazaar

Result

Malware family:

vidar

Score:

10/10

Tags:

family:raccoon family:redline family:smokeloader family:vidar botnet:123123123 botnet:408 botnet:555 botnet:@evilnotlive botnet:newinstallshop backdoor discovery infostealer spyware stealer suricata trojan

Link:

https://tria.ge/reports/210723-behltwv6ma/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Delays execution with timeout.exe

Kills process with taskkill

Modifies registry class

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Accesses 2FA software files, possible credential harvesting

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Reads user/profile data of web browsers

Deletes itself

Loads dropped DLL

Reads user/profile data of local email clients

Downloads MZ/PE file

Executes dropped EXE

Vidar Stealer

Raccoon

RedLine

RedLine Payload

SmokeLoader

Vidar

suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

Malware Config

C2 Extraction:

http://readinglistforjuly1.xyz/
http://readinglistforjuly2.xyz/
http://readinglistforjuly3.xyz/
http://readinglistforjuly4.xyz/
http://readinglistforjuly5.xyz/
http://readinglistforjuly6.xyz/
http://readinglistforjuly7.xyz/
http://readinglistforjuly8.xyz/
http://readinglistforjuly9.xyz/
http://readinglistforjuly10.xyz/
http://readinglistforjuly1.site/
http://readinglistforjuly2.site/
http://readinglistforjuly3.site/
http://readinglistforjuly4.site/
http://readinglistforjuly5.site/
http://readinglistforjuly6.site/
http://readinglistforjuly7.site/
http://readinglistforjuly8.site/
http://readinglistforjuly9.site/
http://readinglistforjuly10.site/
http://readinglistforjuly1.club/
http://readinglistforjuly2.club/
http://readinglistforjuly3.club/
http://readinglistforjuly4.club/
http://readinglistforjuly5.club/
http://readinglistforjuly6.club/
http://readinglistforjuly7.club/
http://readinglistforjuly8.club/
http://readinglistforjuly9.club/
http://readinglistforjuly10.club/
https://shpak125.tumblr.com/
45.32.235.238:45555
3.68.106.170:59223
xaiandaran.xyz:80
135.148.139.222:33569

Unpacked files

SH256 hash:

a072ff0f96f6d1860931b95dafd98722dfb43ff14bc54290451b5e81cb50bf85

MD5 hash:

2ab92457b4aaad3a2e3352a752561a92

SHA1 hash:

4b01947d263d386d8541b2d590a4d7b3f4dd8c87

Link:

https://www.unpac.me/results/589421cf-5bd7-48fd-b7e0-9588ed4504fc/

SH256 hash:

b5f6dd8ed8b59d1928f750db19e5c04d74892c9890eeff8d9805ef2f7152411e

MD5 hash:

a78d99f318fe55b829e1f44b4975d5e2

SHA1 hash:

8e86b2dc11ff92ba81741260f9db701f596984cf

Link:

https://www.unpac.me/results/589421cf-5bd7-48fd-b7e0-9588ed4504fc/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b5f6dd8ed8b59d1928f750db19e5c04d74892c9890eeff8d9805ef2f7152411e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

exe b5f6dd8ed8b59d1928f750db19e5c04d74892c9890eeff8d9805ef2f7152411e

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/1476590/

Cape

https://www.capesandbox.com/analysis/173769/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2021-07-23 19:06:11 UTC

url : hxxp://1freeprivacytoolsforyou.xyz/downloads/toolspab3.exe