MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bcd8f52b8001a64e39f3b0d2d19989527704d472f002c16e82e100eff38605a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 15

Intelligence 15 IOCs YARA 5 File information Comments 1

SHA256 hash:	bcd8f52b8001a64e39f3b0d2d19989527704d472f002c16e82e100eff38605a0
SHA3-384 hash:	a78133929631737b92a190937a840a63502bebd6f12f53333ccb4ed2d55e2820fff5d33fc5b0a432eb4d82d89ea3d18f
SHA1 hash:	ed717ad01c062a3620bc028540a1c689e8c311bf
MD5 hash:	1f6b3bb9c0d1f261ba9cfd32b3710bd7
humanhash:	stairway-eight-mexico-helium
File name:	1f6b3bb9c0d1f261ba9cfd32b3710bd7
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	265'728 bytes
First seen:	2023-10-21 22:07:23 UTC
Last seen:	2023-10-21 22:37:15 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	1a993c5a381c8e12968253c74a42dfae (3 x Smoke Loader, 2 x Stealc, 2 x Tofsee)
ssdeep	3072:Hx1BNncJAZmq9uPvQ0usm/mU2GNXvDukD1EBCo3KND2J:VBCAZB9uHLur7n1DXx9oat
Threatray	2'243 similar samples on MalwareBazaar
TLSH	T1FD44CF2177D1C432E0A769355870C6551A7BFCF29A7141CB33983E3EAE712D19B69B03
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):
dhash icon	70d0ded0c8d4d2dd (1 x Smoke Loader)
Reporter	zbetcheckin
Tags:	32 exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

291

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

1f6b3bb9c0d1f261ba9cfd32b3710bd7

Verdict:

Malicious activity

Analysis date:

2023-10-21 22:08:59 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/72675241-27e9-426f-be71-b5dd37b0846c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win32.BotX-gen.16055.16630.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Enabling the 'hidden' option for recently created files

DNS request

Sending an HTTP POST request

Sending a custom TCP request

Creating a process from a recently created file

Сreating synchronization primitives

Creating a file in the %AppData% directory

Unauthorized injection to a system process

Enabling autorun by creating a file

Gathering data

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/bcd8f52b8001a64e39f3b0d2d19989527704d472f002c16e82e100eff38605a0

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/372b5d38-7806-4263-b1b5-df2fab710d25

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1329771

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/bcd8f52b8001a64e39f3b0d2d19989527704d472f002c16e82e100eff38605a0

Detection:

smokeloader

Link:

https://mwdb.cert.pl/sample/bcd8f52b8001a64e39f3b0d2d19989527704d472f002c16e82e100eff38605a0/

Threat name:

Win32.Trojan.Smokeloader

Status:

Malicious

First seen:

2023-10-21 22:08:06 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

16 of 23 (69.57%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xtmpkk4aagte4optwdjndgmjkj3qjvds6abmc3uc4eao744gawqa._file

Verdict:

malicious

Smoke Loader

2555138d315fe335a9cc77ad2c3f8b0bbd0e066f38db784774b26ba2537a0900

Smoke Loader

8208f19a8329dff98ff72b46b91d53ffe15dc8e9346106c07f5912adcb2d9679

Smoke Loader

8282c76d3fbe900b90d4cc171b116191362effd2ca851d3552742aabbf77ecf9

Smoke Loader

84ef2a0c4a530be1aecad44326446853d4a083a90f3a48fc4954f4a2460671d6

Smoke Loader

8d423d5ee4bc84fc088ff35fda7656d0385d35fe1fd6c3cc575c9699cfbb7e62

Smoke Loader

a9a883582cb7a18b20c2bee6c896342ddb37a8241fc670b75e089ab5eb4b1932

Smoke Loader

d3ff42e30d8fab9324a80f08e50445a1fcf72fa2cfe410043785bf4ff4c637ae

Smoke Loader

eafe43d5f59f732f56db205872cd55690916a0b26874bb080ab752d86704b97d

Smoke Loader

ed5858af8476036c1914ff346745b794c74a98bbb2fa8edba77bfc497a6471a8

Smoke Loader

+ 2'233 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader botnet:pub1 backdoor trojan

Link:

https://tria.ge/reports/231021-117xcacc7x/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Deletes itself

Executes dropped EXE

SmokeLoader

Malware Config

C2 Extraction:

http://wirtshauspost.at/tmp/
http://msktk.ru/tmp/
http://soetegem.com/tmp/
http://gromograd.ru/tmp/
http://talesofpirates.net/tmp/

Unpacked files

SH256 hash:

520163d1e3b4ac0b324cc02a1a63dde672cc11d2b7f5113993b04aa8c3ac0306

MD5 hash:

3c3fe2ea31124a0f22457207e5f84e79

SHA1 hash:

3ad3a6bcd05f431572f96bce57f3811f513d9be4

Detections:

SmokeLoaderStage2

win_smokeloader_a2

Link:

https://www.unpac.me/results/d5024ba0-ee6a-424e-842b-6d2c2040409b/

Parent samples :

1cf4b07955c77e1a4845a1da20bb2cb6d2d244bed78935ef6bec6512d9b5114b
8282c76d3fbe900b90d4cc171b116191362effd2ca851d3552742aabbf77ecf9
476e1c4ca9e0dff520effc75c48b7f3e349c73ab9e4d373646f40a570f846614
91c73aedcbfa2a3726a63259aafea1f73a89b54ad5ba5c2a1747d3927713449a
a675a625f52a13b54c0e28dcccbd6a4004ab262c841f42f9099d7e1b2d8091ff
1b7f969f6188c9980e47c97c8e7bc17588d3c96878baa1589cc3a739823e4b2a
eafe43d5f59f732f56db205872cd55690916a0b26874bb080ab752d86704b97d
ccc3d26959923a2d62322ecdeaa88011e3d29d90af69bc41196cfabe478389c5
aa7a7a2de7f49468905a4441b74991746cfcc9e0243d3874a13b6f76df1d7ec0
f59cc29cd0524b8adee549ec687aae0b9353be4ca5da1a84d62fc90aafaecfe2
84ef2a0c4a530be1aecad44326446853d4a083a90f3a48fc4954f4a2460671d6
bcd8f52b8001a64e39f3b0d2d19989527704d472f002c16e82e100eff38605a0

SH256 hash:

bcd8f52b8001a64e39f3b0d2d19989527704d472f002c16e82e100eff38605a0

MD5 hash:

1f6b3bb9c0d1f261ba9cfd32b3710bd7

SHA1 hash:

ed717ad01c062a3620bc028540a1c689e8c311bf

Link:

https://www.unpac.me/results/d5024ba0-ee6a-424e-842b-6d2c2040409b/

Malware family:

SmokeLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/bcd8f52b8001/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bcd8f52b8001a64e39f3b0d2d19989527704d472f002c16e82e100eff38605a0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__ConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	maldoc_find_kernel32_base_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	pe_no_import_table Create hunting rule
Author:	qux
Description:	Detects exe does not have import table

Rule name:	Windows_Trojan_Smokeloader_3687686f Create hunting rule
Author:	Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

exe bcd8f52b8001a64e39f3b0d2d19989527704d472f002c16e82e100eff38605a0

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2712462/

URLhaus

https://urlhaus.abuse.ch/url/2712491/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-10-21 22:07:24 UTC

url : hxxps://alayyadcare.com/tmp/index.php