MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be08ab1ce25fee08933f9538121460516ae66f5cd881dd06613c0d7c8882e7e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 9

Intelligence 9 IOCs YARA File information Comments 1

SHA256 hash:	be08ab1ce25fee08933f9538121460516ae66f5cd881dd06613c0d7c8882e7e0
SHA3-384 hash:	fdcbbd02cd63de0443c38f25c3ed0a9b94ff104d8ecf0e11c2ece8ffa1ae515e23b9df14449b6038924452d9cc215433
SHA1 hash:	712681c4023e6740af3f84173acbbbed6712f84a
MD5 hash:	21d358169c1d7504d329a53dd73f5d63
humanhash:	harry-early-eleven-carolina
File name:	21d358169c1d7504d329a53dd73f5d63
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	196'096 bytes
First seen:	2021-08-03 15:48:07 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	41772127f978069b9f399090f08eba15 (4 x Smoke Loader, 3 x RaccoonStealer, 1 x DanaBot)
ssdeep	3072:+9zv6lmeWe0PQDxwymlKCobtsW12SLAcPVAgF5ZnetCDArywoOLi6:+5e1wPkxwymlKCobtsW12SLAcygBzRwh
Threatray	608 similar samples on MalwareBazaar
TLSH	T1AB14AD103980CA72D1271571B87DF2B06B26BC755F319A8B3FF5766D0E3A2D2AA1434E
dhash icon	1272d292105c5c03 (31 x RaccoonStealer, 6 x Smoke Loader, 4 x Loki)
Reporter	zbetcheckin
Tags:	32 exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

160

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

21d358169c1d7504d329a53dd73f5d63

Verdict:

Suspicious activity

Analysis date:

2021-08-03 15:50:00 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/4678186d-474e-463a-9799-6eaf80114845

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/176119/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Sending a custom TCP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Creating a file in the %temp% directory

Creating a process from a recently created file

Creating a file

Deleting a recently created file

Creating a file in the %AppData% subdirectories

Moving a file to the %AppData% subdirectory

Searching for analyzing tools

Searching for the window

Connection attempt

Sending an HTTP POST request

DNS request

Sending an HTTP GET request

Using the Windows Management Instrumentation requests

Reading critical registry keys

Launching a process

Setting browser functions hooks

Unauthorized injection to a recently created process

Query of malicious DNS domain

Connection attempt to an infection source

Sending a TCP request to an infection source

Stealing user critical data

Unauthorized injection to a system process

Deleting of the original file

Enabling autorun by creating a file

Sending an HTTP POST request to an infection source

Sending an HTTP GET request to an infection source

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

SmokeLoader

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e7573afb-85c2-4071-a13c-8892ffeef720

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/826319

Signature

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/be08ab1ce25fee08933f9538121460516ae66f5cd881dd06613c0d7c8882e7e0/

Threat name:

Win32.Trojan.Sabsik

Status:

Malicious

First seen:

2021-08-03 15:48:09 UTC

AV detection:

29 of 46 (63.04%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xyekwhhcl7xarez7su4befdakfvom3243ca52btbhqgxzcec47qa._file

Verdict:

suspicious

Smoke Loader

4a1f935a5f94e5b3d7d0c79dcd01a96d69650bfeadc4a49d6548b118e82e1e16

Smoke Loader

5d2140c3ab1944f381206aa8d5c3ae0e5c2dad60751d3a2f631b1b08a810baa2

Smoke Loader

76526cd30725afafe90b7f19fbb607571ac7f827aece34bf1d1cc41c595f2a93

Smoke Loader

a3eaf45cf366908149a9143b9426bfa6c3dacca3ffb910031c2d7d65fa51fd0d

Smoke Loader

d1697994428238aced8ff24acff0b131d9737a0659a81e4a7395a746c5ce353e

Smoke Loader

d3849946eb2dd2aa6bebcddb30751a4a99bc05ee5011db3f5081df2f970a1854

Smoke Loader

fe74f3ee571f291acdaa6d0546bc16e7d5feb3ca1bd6ad1fb3c74b73483b871b

Smoke Loader

fff093b2593add9b7f59377b88e4e9586a8b728d82df197aad087d7e95615fd9

Smoke Loader

+ 598 additional samples on MalwareBazaar

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:raccoon family:redline family:smokeloader family:vidar family:xmrig botnet:408 botnet:cd8dc1031358b1aec55cc6bc447df1018b068607 botnet:test backdoor discovery evasion infostealer miner spyware stealer suricata themida trojan

Link:

https://tria.ge/reports/210803-6j7gwgy74x/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Creates scheduled task(s)

Delays execution with timeout.exe

Kills process with taskkill

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Windows directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses 2FA software files, possible credential harvesting

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks whether UAC is enabled

Checks BIOS information in registry

Deletes itself

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Themida packer

Downloads MZ/PE file

Executes dropped EXE

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Vidar Stealer

Raccoon

Raccoon Stealer Payload

RedLine

RedLine Payload

SmokeLoader

Vidar

suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

xmrig

Malware Config

C2 Extraction:

http://readinglistforjuly1.xyz/
http://readinglistforjuly2.xyz/
http://readinglistforjuly3.xyz/
http://readinglistforjuly4.xyz/
http://readinglistforjuly5.xyz/
http://readinglistforjuly6.xyz/
http://readinglistforjuly7.xyz/
http://readinglistforjuly8.xyz/
http://readinglistforjuly9.xyz/
http://readinglistforjuly10.xyz/
http://readinglistforjuly1.site/
http://readinglistforjuly2.site/
http://readinglistforjuly3.site/
http://readinglistforjuly4.site/
http://readinglistforjuly5.site/
http://readinglistforjuly6.site/
http://readinglistforjuly7.site/
http://readinglistforjuly8.site/
http://readinglistforjuly9.site/
http://readinglistforjuly10.site/
http://readinglistforjuly1.club/
http://readinglistforjuly2.club/
http://readinglistforjuly3.club/
http://readinglistforjuly4.club/
http://readinglistforjuly5.club/
http://readinglistforjuly6.club/
http://readinglistforjuly7.club/
http://readinglistforjuly8.club/
http://readinglistforjuly9.club/
http://readinglistforjuly10.club/
205.185.119.191:18846
https://prophefliloc.tumblr.com/