MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c65ea9eee506b0a71170d4e3778d3ccadda12f67217e89e3b93db61890ab548d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c65ea9eee506b0a71170d4e3778d3ccadda12f67217e89e3b93db61890ab548d
SHA3-384 hash: 40c28bc549171ac36c5923fda36053f39335c0f6d2286538a41be8d71626dcac325f36672b45d6f146429b825215ffc5
SHA1 hash: 123ba07b28b49215d4d7b83fbf38cb2a9e0c8b56
MD5 hash: 057887b52388981063d44ae2ffff29a7
humanhash: comet-harry-alabama-six
File name:057887b52388981063d44ae2ffff29a7.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:162'816 bytes
First seen:2021-01-21 17:56:35 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4d0c2c3fc68c5c4083f586c94298db5d (3 x Smoke Loader)
ssdeep 3072:8MPteR4L+EMo6s3oiTZI3pxB77BOaLSieYvAXTROAeF8q:8MPteR4LxMxsYiTZCpxV7smNTcEtF8q
Threatray 250 similar samples on MalwareBazaar
TLSH FCF3BF313A92D0B3C55B283158A4DBA06FBEFD726675458737A92B7E9F302D00726B07
Reporter abuse_ch
Tags:Dofoil exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
493
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Додатковi угоди Енергогаз вiд 11.01.2021р.js
Verdict:
Malicious activity
Analysis date:
2021-01-21 17:37:38 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/062a3d9e-0c29-4a42-8f5e-d89f53af7489

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/113348/
Detection(s):
Win.Packed.Generickdz-9823562-0
Create hunting rule

Win.Packed.Generickdz-9823563-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Sending a UDP request
Creating a file in the %temp% directory
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Connection attempt
Sending an HTTP POST request
Deleting of the original file
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/587583
Signature
Benign windows process drops PE files
Binary contains a suspicious time stamp
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Renames NTDLL to bypass HIPS
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 342813 Sample: dif019MoIw.exe Startdate: 21/01/2021 Architecture: WINDOWS Score: 100 26 g.msn.com 2->26 40 Multi AV Scanner detection for domain / URL 2->40 42 Multi AV Scanner detection for submitted file 2->42 44 Yara detected SmokeLoader 2->44 46 3 other signatures 2->46 7 dif019MoIw.exe 1 2->7         started        10 bwjrvce 1 2->10         started        12 bwjrvce 1 2->12         started        signatures3 process4 file5 48 Detected unpacking (changes PE section rights) 7->48 50 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 7->50 52 Renames NTDLL to bypass HIPS 7->52 15 explorer.exe 2 7->15 injected 54 Multi AV Scanner detection for dropped file 10->54 56 Machine Learning detection for dropped file 10->56 58 Maps a DLL or memory area into another process 10->58 24 C:\Users\user\AppData\Local\Temp\9419.tmp, PE32 12->24 dropped 60 Checks if the current machine is a virtual machine (disk enumeration) 12->60 62 Creates a thread in another existing process (thread injection) 12->62 signatures6 process7 dnsIp8 28 gmbshop.ru 93.170.123.43, 80 IHOR-ASRU Czech Republic 15->28 30 mpmanagertzz.ru 15->30 32 8 other IPs or domains 15->32 20 C:\Users\user\AppData\Roaming\bwjrvce, PE32 15->20 dropped 22 C:\Users\user\...\bwjrvce:Zone.Identifier, ASCII 15->22 dropped 34 Benign windows process drops PE files 15->34 36 Deletes itself after installation 15->36 38 Hides that the sample has been downloaded from the Internet (zone.identifier) 15->38 file9 signatures10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c65ea9eee506b0a71170d4e3778d3ccadda12f67217e89e3b93db61890ab548d/
Threat name:
Win32.Trojan.Zurgop
Create hunting rule
Status:
Malicious
First seen:
2021-01-21 11:26:40 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0b9555e73d90f0ff2506c001b5fed2e986f74e8e988cc1a4a8dc0e1dd377113b
Smoke Loader
6aceacb6120a5a270ad7906dcedc5fcf3059323b6c2f52e5b3eb83a91630ed8f
Smoke Loader
73bd0ef4821814fb351197b6967d35274f9f33de491faca434aeeb63a51072bb
Smoke Loader
7f40d0fe270f72aec76ec5348630f3b354ea4dd010d60edcdd865693824981de
Smoke Loader
824bb4f0ae66624021f9428d253f15f751653dfb059f9a2db4a6551b0a168a0b
Smoke Loader
82c5a4103769e5391fee93ead9d6509dd3eb8186f53ce450f14a22b4f82e968c
Smoke Loader
9e5f370201251e8dc138678f8e0d4f0bdd75e1353edcc77d41c8401621c2c671
Smoke Loader
d4e87e3eb3e3a5e08db5a708bd95fedac322088446c87ba37f0aeca529a928cc
Smoke Loader
f69bdd82ca22268d090832707e37b1cae408ba96476843b55feedac11acc6277
Smoke Loader
fcb987579a7161622043553819e18e3dee2e50ea149e5b7438ac614548278405
Smoke Loader
+ 240 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor trojan
Link:
https://tria.ge/reports/210121-y4k2b42786/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Deletes itself
Loads dropped DLL
SmokeLoader
Malware Config
C2 Extraction:
http://smbproperty.ru/
http://gmbshop.ru/
http://baksproperty.gov.ug/
http://magistralpsw.ru/
http://mpmanagertzz.ru/
http://powerglasspot.ru/
http://autopartswarehouses.ru/
http://memoloves.ru/
http://alfavanilin.ru/
Unpacked files
SH256 hash:
cd134fe58081acd7559cfcab15a717c7f9bc8947e94b539660975bebf8546f13
MD5 hash:
01a9c23c98d12fb28009e2de85352385
SHA1 hash:
947c4181eddfdde49342dc9566654d80062bfbd2
Link:
https://www.unpac.me/results/25c48d78-b5d8-4dc7-b46b-ab3694d8c35e/
SH256 hash:
c65ea9eee506b0a71170d4e3778d3ccadda12f67217e89e3b93db61890ab548d
MD5 hash:
057887b52388981063d44ae2ffff29a7
SHA1 hash:
123ba07b28b49215d4d7b83fbf38cb2a9e0c8b56
Link:
https://www.unpac.me/results/25c48d78-b5d8-4dc7-b46b-ab3694d8c35e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Smokeloader
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c65ea9eee506b0a71170d4e3778d3ccadda12f67217e89e3b93db61890ab548d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe c65ea9eee506b0a71170d4e3778d3ccadda12f67217e89e3b93db61890ab548d

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/113348/
  
URLhaus
https://urlhaus.abuse.ch/url/949301/
  
Delivery method
Distributed via web download

Comments