MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b751a245f558db84cf77e46e473073e2dd23fbde9f9d150d63e525bbf4b88e8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b751a245f558db84cf77e46e473073e2dd23fbde9f9d150d63e525bbf4b88e8c
SHA3-384 hash: ebf12bc46bd7e1be9b1a4bd97bec6ac5205e4bdcc2125248413a29e9bc5e53e7f4ee05464c1c9fd1cc92fbb97e5d3f0b
SHA1 hash: 4f8ee409345d50a626a3a3f963364ed0bb5a9644
MD5 hash: 7aa2be816ab6bd4f9decb75fd31e0f29
humanhash: whiskey-steak-september-green
File name:7aa2be816ab6bd4f9decb75fd31e0f29.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:303'104 bytes
First seen:2021-06-18 06:43:27 UTC
Last seen:2021-06-18 07:48:53 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 0e61e5ee811a73c290e64659dd192375 (2 x Smoke Loader, 2 x Stop, 2 x RedLineStealer)
ssdeep 6144:7CwuWDYsxNANSOqelTe4Us6VLVzEUac7yyj2lt2lC:9uW8sxNANSOqe96VLVQUac77jGm
Threatray 1'695 similar samples on MalwareBazaar
TLSH CD547C10ABA0C035F6F722F84976A37DA52C7EB05B3450CB96D52AEA57346E0EC3171B
Reporter abuse_ch
Tags:Dofoil exe Smoke Loader

Intelligence

File Origin
# of uploads :
2
# of downloads :
263
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7aa2be816ab6bd4f9decb75fd31e0f29.exe
Verdict:
Suspicious activity
Analysis date:
2021-06-18 06:45:21 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/45a17c5e-2d3e-4cb3-a39d-6210e8b0f516

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/166745/
Detection(s):
SecuriteInfo.com.Troj.Kryptik-TR.1839.10495.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/07bf23c6-3f73-4ac3-b155-0dfd498ebe14
Result
Threat name:
Raccoon RedLine SmokeLoader Tofsee Vidar
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/804170
Signature
.NET source code contains very large strings
Allocates memory in foreign processes
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
DLL reload attack detected
Drops executables to the windows directory (C:\Windows) and starts them
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the windows firewall
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Renames NTDLL to bypass HIPS
Sigma detected: Copying Sensitive Files with Credential Data
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious Svchost Process
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to resolve many domain names, but no domain seems valid
Tries to steal Crypto Currency Wallets
Tries to steal Mail credentials (via file access)
Uses netsh to modify the Windows network and firewall settings
Writes to foreign memory regions
Yara detected Raccoon Stealer
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Tofsee
Yara detected Vidar stealer
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 436578 Sample: oS4iWYYsx7.exe Startdate: 18/06/2021 Architecture: WINDOWS Score: 100 81 api.ip.sb 2->81 83 18.52.17.84.in-addr.arpa 2->83 85 microsoft-com.mail.protection.outlook.com 2->85 105 Found malware configuration 2->105 107 Antivirus detection for URL or domain 2->107 109 Multi AV Scanner detection for submitted file 2->109 111 17 other signatures 2->111 9 explorer.exe 19 2->9         started        14 oS4iWYYsx7.exe 2->14         started        16 juegrhi 2->16         started        18 5 other processes 2->18 signatures3 process4 dnsIp5 97 999080321yes1t3481-service10020125999080321.ru 9->97 99 999080321utest1341-service10020125999080321.ru 9->99 103 25 other IPs or domains 9->103 73 C:\Users\user\AppData\Roaming\juegrhi, PE32 9->73 dropped 75 C:\Users\user\AppData\Local\Temp\5EB8.exe, PE32 9->75 dropped 77 C:\Users\user\AppData\Local\Temp\5774.exe, PE32 9->77 dropped 79 7 other files (5 malicious) 9->79 dropped 139 System process connects to network (likely due to code injection or exploit) 9->139 141 Benign windows process drops PE files 9->141 143 Performs DNS queries to domains with low reputation 9->143 163 3 other signatures 9->163 20 5EB8.exe 9->20         started        25 2D73.exe 2 9->25         started        27 explorer.exe 9->27         started        35 14 other processes 9->35 145 DLL reload attack detected 14->145 147 Detected unpacking (changes PE section rights) 14->147 149 Contains functionality to inject code into remote processes 14->149 151 Injects a PE file into a foreign processes 14->151 29 oS4iWYYsx7.exe 1 14->29         started        153 Machine Learning detection for dropped file 16->153 31 juegrhi 1 16->31         started        101 192.168.2.1 unknown unknown 18->101 155 Detected unpacking (overwrites its own PE header) 18->155 157 Writes to foreign memory regions 18->157 159 Allocates memory in foreign processes 18->159 33 svchost.exe 18->33         started        file6 161 Tries to resolve many domain names, but no domain seems valid 99->161 signatures7 process8 dnsIp9 87 159.69.20.131, 49783, 80 HETZNER-ASDE Germany 20->87 89 bandakere.tumblr.com 74.114.154.18, 443, 49782 AUTOMATTICUS Canada 20->89 61 C:\Users\user\AppData\...\vcruntime140[1].dll, PE32 20->61 dropped 63 C:\Users\user\AppData\...\mozglue[1].dll, PE32 20->63 dropped 65 C:\Users\user\AppData\Local\...\nss3[1].dll, PE32 20->65 dropped 71 9 other files (none is malicious) 20->71 dropped 113 Detected unpacking (changes PE section rights) 20->113 115 Detected unpacking (overwrites its own PE header) 20->115 117 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 20->117 133 2 other signatures 20->133 67 C:\Users\user\AppData\Local\...\wjinxios.exe, PE32 25->67 dropped 119 Machine Learning detection for dropped file 25->119 121 Uses netsh to modify the Windows network and firewall settings 25->121 123 Modifies the windows firewall 25->123 37 cmd.exe 25->37         started        39 cmd.exe 25->39         started        41 sc.exe 25->41         started        47 3 other processes 25->47 91 999080321test51-service10020125999080321.xyz 27->91 125 System process connects to network (likely due to code injection or exploit) 27->125 127 Tries to steal Mail credentials (via file access) 27->127 129 Performs DNS queries to domains with low reputation 27->129 135 2 other signatures 29->135 69 C:\Users\user\AppData\Local\Temp\AE30.tmp, PE32 31->69 dropped 137 3 other signatures 31->137 93 microsoft-com.mail.protection.outlook.com 104.47.53.36, 25, 49786, 49790 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 33->93 95 tttttt.me 95.216.186.40, 443, 49779 HETZNER-ASDE Germany 35->95 131 Injects a PE file into a foreign processes 35->131 43 2573.exe 2 35->43         started        45 conhost.exe 35->45         started        file10 signatures11 process12 process13 49 conhost.exe 37->49         started        51 conhost.exe 39->51         started        53 conhost.exe 41->53         started        55 conhost.exe 47->55         started        57 conhost.exe 47->57         started        59 conhost.exe 47->59         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b751a245f558db84cf77e46e473073e2dd23fbde9f9d150d63e525bbf4b88e8c/
Threat name:
Win32.Backdoor.Mokes
Create hunting rule
Status:
Malicious
First seen:
2021-06-18 06:44:14 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
16 of 46 (34.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=w5i2erpvldnyjt3x4rxeomdt4losh666t6orkdld4us3x5fyr2ga._file
Verdict:
malicious
Similar samples:
13cb7156b54db1b9d8ff5c405e9324899cd7ef801bdff04b1155dd9b104f7cdc
Smoke Loader
1b7769f85c3874451b85f83ab1ddc08b0d07fe76f354e0c7b397308894095673
Smoke Loader
63761462358e1f880dafe51b3de8036f10bc60354b981cddc8075aed22e1251d
Smoke Loader
653d4491de7461361a379e7ed09e172c06d669d25fed55f134a1b278827f2efe
Smoke Loader
90c0cf976bc9377697fb31e8ca6f21aee0168cc5471a8ac33ece631ee346afa9
Smoke Loader
a30aa51bc0554b2dedf5f0a7f29219ad301a97b5e6e4215f42973bb010345d3c
Smoke Loader
ae7ae9ea7fd0100b620704d462083caaedda2c5c5618ceeca54c1d7673b6be4a
Smoke Loader
b2c71a3b927301a484057e79c1d8a08c45512181b6378ca2627d34ddec49d4f4
Smoke Loader
cce83bbb9fcc128a53c6f788a976bce242447d6c73deb097002ce9bb45b89cd0
Smoke Loader
fbfa62c89bfaaed698109746a79c019e2143c497371f5bd2a8f7ae95cec195f1
Smoke Loader
+ 1'685 additional samples on MalwareBazaar
Result
Malware family:
vidar
Create hunting rule
Score:
  10/10
Tags:
family:raccoon family:redline family:smokeloader family:tofsee family:vidar botnet:50f8ded12c46443e43915127b1219ac2fc439bb6 backdoor discovery evasion infostealer persistence spyware stealer trojan
Link:
https://tria.ge/reports/210618-55jfhdl51e/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Delays execution with timeout.exe
Kills process with taskkill
Modifies data under HKEY_USERS
Modifies registry class
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of UnmapMainImage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Launches sc.exe
Drops file in System32 directory
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Deletes itself
Loads dropped DLL
Reads user/profile data of local email clients
Reads user/profile data of web browsers
Creates new service(s)
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
Sets service image path in registry
Vidar Stealer
Raccoon
RedLine
RedLine Payload
SmokeLoader
Tofsee
Vidar
Windows security bypass
Malware Config
C2 Extraction:
http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
http://999080321test61-service10020125999080321.website/
http://999080321test51-service10020125999080321.xyz/
http://999080321test41-service100201pro25999080321.ru/
http://999080321yest31-service100201rus25999080321.ru/
http://999080321rest21-service10020125999080321.eu/
http://999080321test11-service10020125999080321.press/
http://999080321newfolder4561-service10020125999080321.ru/
http://999080321rustest213-service10020125999080321.ru/
http://999080321test281-service10020125999080321.ru/
http://999080321test261-service10020125999080321.space/
http://999080321yomtest251-service10020125999080321.ru/
http://999080321yirtest231-service10020125999080321.ru/
Unpacked files
SH256 hash:
6cc63b665ea65def9c5f8c4f1c73e2124e041cdc6c55fda6a464cdc19420a273
MD5 hash:
5cff71255f4b94a23e2bb7520601d90b
SHA1 hash:
2f236e55ba4873e11400e10755bfecd5443bf2c4
Link:
https://www.unpac.me/results/9035313f-d841-4d47-a6be-758ba6252974/
SH256 hash:
b751a245f558db84cf77e46e473073e2dd23fbde9f9d150d63e525bbf4b88e8c
MD5 hash:
7aa2be816ab6bd4f9decb75fd31e0f29
SHA1 hash:
4f8ee409345d50a626a3a3f963364ed0bb5a9644
Link:
https://www.unpac.me/results/9035313f-d841-4d47-a6be-758ba6252974/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b751a245f558db84cf77e46e473073e2dd23fbde9f9d150d63e525bbf4b88e8c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe b751a245f558db84cf77e46e473073e2dd23fbde9f9d150d63e525bbf4b88e8c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1362311/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/166745/

Comments