MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3fdaef5156fa09f11e50ee587c4ed410e5d7e93f61b25ef9baad83ddf32d6bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 9

Intelligence 9 IOCs YARA File information Comments

SHA256 hash:	c3fdaef5156fa09f11e50ee587c4ed410e5d7e93f61b25ef9baad83ddf32d6bf
SHA3-384 hash:	17a4812b964252b873501a7680ca7b7e8b22b76e2bf98cbd3f14ec3c1bbe2820130940aec3a06ded6f5d1b27d5547c59
SHA1 hash:	5555d54dddd409a94eecceedf11e99ab7a8d4ca3
MD5 hash:	2bbd69e3cba9c3877c340958fd414b9b
humanhash:	cardinal-virginia-network-friend
File name:	2bbd69e3cba9c3877c340958fd414b9b.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	212'992 bytes
First seen:	2021-08-30 18:03:33 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	9ed1d013ce7207f0483aa63315aab3fd (10 x RaccoonStealer, 4 x ArkeiStealer, 2 x RedLineStealer)
ssdeep	3072:vuyLPaAKYAda/0TEUSVgejmHd7cxatBgGgS/lPYxAxA+:myLPaARAd0DUSRgFVg8FY6xA
Threatray	3'995 similar samples on MalwareBazaar
TLSH	T12224BF10F6A3F42EF44556708651CAA35636AD71DD60C347B32B2B5E2F322907F16EE2
dhash icon	fcfcd4d4d4dcd8c0 (52 x RaccoonStealer, 28 x RedLineStealer, 6 x Smoke Loader)
Reporter	abuse_ch
Tags:	Dofoil exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

989

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

2bbd69e3cba9c3877c340958fd414b9b.exe

Verdict:

Suspicious activity

Analysis date:

2021-08-30 18:05:24 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/7d99d3ba-60b8-4de9-b053-1d867ecc57b0

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/183870/

Detection(s):

SecuriteInfo.com.Artemis2BBD69E3CBA9.25190.22380.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Connection attempt

Sending a UDP request

Sending an HTTP POST request

Sending an HTTP GET request

Creating a file in the %temp% directory

Creating a process from a recently created file

Launching the default Windows debugger (dwwin.exe)

Connection attempt to an infection source

Launching a process

Searching for the window

Reading critical registry keys

Changing a file

Creating a file in the %AppData% subdirectories

Deleting a recently created file

Running batch commands

Creating a process with a hidden window

Setting browser functions hooks

Query of malicious DNS domain

Sending a TCP request to an infection source

Unauthorized injection to a system process

Deleting of the original file

Enabling autorun by creating a file

Unauthorized injection to a browser process

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/0dcc0a71-a86f-4c97-97e9-25fe054b6536

Result

Threat name:

Raccoon RedLine SmokeLoader

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/841839

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

Binary or sample is protected by dotNetProtector

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to detect sleep reduction / modifications

Contains functionality to inject code into remote processes

Contains functionality to steal Internet Explorer form passwords

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

System process connects to network (likely due to code injection or exploit)

Tries to delay execution (extensive OutputDebugStringW loop)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file access)

Writes to foreign memory regions

Yara detected Raccoon Stealer

Yara detected RedLine Stealer

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c3fdaef5156fa09f11e50ee587c4ed410e5d7e93f61b25ef9baad83ddf32d6bf/

Threat name:

Win32.Trojan.Fragtor

Status:

Malicious

First seen:

2021-08-30 18:04:08 UTC

AV detection:

13 of 28 (46.43%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=yp6255ivn6qj6epfb3syprhniehf27ut6ynsl343vlmd3xzs227q._file

Verdict:

suspicious

Smoke Loader

11d175a08e1f4fc351af4e4c2c0549168d4c235a497f3bc1f278e8cb46b972e1

Smoke Loader

5152274dbe1cc44da156f29d1ff2858e583237bdc24ced137265cd3668ba851e

Smoke Loader

5fc5ab3f922510924c13f1018ba4d5d94f990f3885da41d68a38603020cf9b27

Smoke Loader

608248c1ef7bab54f8a7aeffaf618187a6f20d3bc829a6c6de625e2a2a376f2b

Smoke Loader

92e576963128d956b98f423af33a3a2395e6a16f7d44855cfc2fff71c0651329

Smoke Loader

a19317b14abc6d4c1294aaaeab29d0ada023dffa37025c839671c193a74fd519

Smoke Loader

e9abbf811d367cf26f493d72ccd96749e534804ac27d36956dce0484b1440f25

Smoke Loader

+ 3'985 additional samples on MalwareBazaar

Result

Malware family:

tofsee

Score:

10/10

Tags:

family:raccoon family:smokeloader family:tofsee botnet:fe582536ec580228180f270f7cb80a867860e010 backdoor discovery evasion persistence spyware stealer trojan

Link:

https://tria.ge/reports/210830-4wzp4mf3lx/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Modifies data under HKEY_USERS

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Launches sc.exe

Drops file in System32 directory

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Deletes itself

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Sets service image path in registry

Creates new service(s)

Raccoon

SmokeLoader

Suspicious use of NtCreateProcessExOtherParentProcess

Tofsee

Windows security bypass

Malware Config

C2 Extraction:

http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/