MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c23c7b2df7d2378e819af3ea1fbf7392f77a6c996fe59ecef732f205b824a9d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 2


Intelligence 2 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c23c7b2df7d2378e819af3ea1fbf7392f77a6c996fe59ecef732f205b824a9d3
SHA3-384 hash: d5944d53491b9750a5c20dc993faa456b9ea88239f4d39fffdc345e33a8bc2064dc6ad1582e988bd7af6721658db2dc9
SHA1 hash: aee85e0dc0b7e5127fa080b2caf7a71b4ed1d351
MD5 hash: a96e8357843fc06b4045283cfc11a7c5
humanhash: don-fifteen-ohio-steak
File name:a96e8357843fc06b4045283cfc11a7c5.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:3'072 bytes
First seen:2020-05-22 06:30:16 UTC
Last seen:2020-05-22 08:02:51 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 66a367ccc5963e9848bc44cfb4270bf7 (2 x Smoke Loader)
ssdeep 48:6z7JMhAJoCp+F6HmAhjwda0I6HmAhDuadqmXy:wCAJo9WmACiWmAwa0
TLSH 3751C23A9A74F9D0C35FB1F046B62E4530A58A23C7716A64C5101CF62A34B85DF3B24D
Reporter abuse_ch
Tags:exe Smoke Loader


Avatar
abuse_ch
Smoke Loader C2:
http://britbox.us/a/

Intelligence

File Origin
# of uploads :
2
# of downloads :
72
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.DownLoader33.39954.13522.19796.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Scrami
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 01:52:16 UTC
File Type:
PE (Exe)
AV detection:
22 of 31 (70.97%)
Threat level:
  2/5
Verdict:
unknown
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-mq41xglnmj/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Blacklisted process makes network request
Malware Config
Dropper Extraction:
httP://paste.ee/r/Y3pKh
httPs://paste.ee/r/47v7E
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PowerShell_Case_Anomaly
Create hunting rule
Author:Florian Roth
Description:Detects obfuscated PowerShell hacktools
Reference:https://twitter.com/danielhbohannon/status/905096106924761088

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe c23c7b2df7d2378e819af3ea1fbf7392f77a6c996fe59ecef732f205b824a9d3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/366360/
  
Delivery method
Distributed via web download

Comments