MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5adf0828a7f84fa39ba221b321f7a4246dd29f2a3fe172e3992f943362f79eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 7

Intelligence 7 IOCs YARA File information Comments

SHA256 hash:	c5adf0828a7f84fa39ba221b321f7a4246dd29f2a3fe172e3992f943362f79eb
SHA3-384 hash:	b57427458af95067b90fed8a8d090999e72438bfc568a919a1fc8a2ea0451cdaf67656615c48e290e3f93655787c5cd6
SHA1 hash:	bcf1f989f763cf922f8f2f941647a5f9574887e7
MD5 hash:	68ae12a736293b56bc79182ffa241a2c
humanhash:	monkey-pip-ceiling-nevada
File name:	SecuriteInfo.com.Trojan.GenericKDZ.78846.28607.27752
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	345'600 bytes
First seen:	2021-10-11 02:44:49 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f9ea7fd19aba2d67c1ba609de266a8db (4 x ArkeiStealer, 3 x Smoke Loader, 1 x Arkei)
ssdeep	6144:G5eV0uWDSsSD3rNZrnRHUwmavoOMJWVnboU6H3IBK:eH5Sr5ZLRHUIvkJMnboP0
Threatray	5'008 similar samples on MalwareBazaar
TLSH	T164747D00B7AEC0F4F1F216F959B99268A52E7DA16B2494CF32C426FE56356D0EC32317
File icon (PE):
dhash icon	9824e7d0c6672158 (1 x Smoke Loader)
Reporter	SecuriteInfoCom
Tags:	exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

177

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

SecuriteInfo.com.Trojan.GenericKDZ.78846.28607.27752

Verdict:

No threats detected

Analysis date:

2021-10-11 02:45:58 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/84c9d69b-f59f-4ebe-97c2-01b0aa455eab

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/196423/

Detection(s):

SecuriteInfo.com.Trojan.GenericKDZ.78846.28607.27752.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Launching the default Windows debugger (dwwin.exe)

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware

Link:

https://www.filescan.io/uploads/6163a5313831960005b39cdf/reports/e6672396-0161-4e22-95d8-721eb974060c/overview

Result

Threat name:

RedLine SmokeLoader

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/868359

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Connects to many ports of the same IP (likely port scanning)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Yara detected RedLine Stealer

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c5adf0828a7f84fa39ba221b321f7a4246dd29f2a3fe172e3992f943362f79eb/

Threat name:

Win32.Packed.Generic

Status:

Suspicious

First seen:

2021-10-11 00:52:27 UTC

AV detection:

19 of 45 (42.22%)

Threat level:

1/5

Verdict:

malicious

Smoke Loader

296cb7c456c55688de080e9940722307f1ee92acbfec61696e21ec985794a3ff

Smoke Loader

5e1a4b9ced78b15872e2723b231e3934c4874c6ea28ebf6c983a61f5040b5f96

Smoke Loader

91949edb9145bda3b1336a5513c44707a86300ca5a378411c9bf8800b8127db9

Smoke Loader

9f154115fa8045aa05f15f7cd1de9623ebe32e8ea400279ecb5dfa3596952e3b

Smoke Loader

dcf60583940d9683d950022fc0ff511ea3a7364b728635eb904d28460200dd98

Smoke Loader

e0caf6fb02b0ef2bd64b0e04e1793a502b4a3b350a5be41c1baea88842530383

Smoke Loader

edf6beb88780fb3085332f843b73418f52bbf095265dad631cf8e187644cb565

Smoke Loader

+ 4'998 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:redline family:smokeloader botnet:new backdoor discovery infostealer spyware stealer trojan

Link:

https://tria.ge/reports/211011-c8q2ssgcd6/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Deletes itself

Reads user/profile data of web browsers

Downloads MZ/PE file

Executes dropped EXE

RedLine

RedLine Payload

SmokeLoader

Malware Config

C2 Extraction:

http://gmpeople.com/upload/
http://mile48.com/upload/
http://lecanardstsornin.com/upload/
http://m3600.com/upload/
http://camasirx.com/upload/
45.9.20.107:46187

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/c5adf0828a7f/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c5adf0828a7f84fa39ba221b321f7a4246dd29f2a3fe172e3992f943362f79eb