MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c78663af760456420e3e699a22f0eae8dc077e008006eeed6e9a9862bd1e46cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	c78663af760456420e3e699a22f0eae8dc077e008006eeed6e9a9862bd1e46cd
SHA3-384 hash:	5117f01d7060771e259133e525ab2d24224b92675ab648c5b39a2a62885c530c230af28fad3f4fb7b8511bb0c603ab6c
SHA1 hash:	96a7bacc74a09455a0026a74b744ffd90b41122b
MD5 hash:	a0416e457f23a51aae303be172cb5dab
humanhash:	venus-beer-cardinal-chicken
File name:	a0416e457f23a51aae303be172cb5dab.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	359'936 bytes
First seen:	2020-11-11 16:43:20 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	957f451a9a7944a1fbdb8d7ab72b6645 (5 x Smoke Loader)
ssdeep	6144:DTxeaar8fBrLnCPXOlxmEZhjTyRKKt5viw0B53:3AaaCBruPXOmeM0
Threatray	127 similar samples on MalwareBazaar
TLSH	B574BE117691C0F2D5A606384865F3A15ABABC750B30DACB2B84376E5F353E29A3D3C7
Reporter	abuse_ch
Tags:	exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

PUA.Win.Downloader.Firseria-6804617-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Sending a UDP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Deleting of the original file

Enabling autorun by creating a file

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/530978

Signature

Benign windows process drops PE files

Binary contains a suspicious time stamp

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Renames NTDLL to bypass HIPS

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c78663af760456420e3e699a22f0eae8dc077e008006eeed6e9a9862bd1e46cd/

Threat name:

Win32.Trojan.Glupteba

Status:

Malicious

First seen:

2020-11-12 00:21:58 UTC

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=y6dghl3warleedr6ngncf4hk5doao7qaqado53lotkmgfpi6i3gq._file

Verdict:

suspicious

Smoke Loader

2c10f6776795d59fe038ed6b7ff9e2d1a710a027a35845e34e4cd5fef17892f8

Smoke Loader

2e8088a31e158e71911322a9fda5eaf609616e574d76932f849cc55f2c184211

Smoke Loader

4f86f65a5437398451da41f7fb8a99dc4b11b39899a3cb73198b814cf7e15101

Smoke Loader

51b64f2828c607dc4ef107428363fe9ad51e09c10e5778537bcf1ffc4c380a23

Smoke Loader

76fe343785baa82890e56eafb11c61b0422e7a7820601d3795fd87ec972fba52

Smoke Loader

810054919862bbf27f86e170be95aa80bc516a99704fc46103f24905a8099401

Smoke Loader

860ce43cef0bbd5b0447f02c55a6c0827aa09e3b7d537b1167bd67047980ab93

Smoke Loader

ab3cdb12407fd462c852a5d4565dfde55ff3baaf019f99125970d4355c238a09

Smoke Loader

efa0b8e5a18bc36c173b2b891b7df7dc3b5419c115adb3952c951219a282d25d

Smoke Loader

+ 117 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor trojan

Link:

https://tria.ge/reports/201111-1ykpx6dawx/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of UnmapMainImage

Deletes itself

Loads dropped DLL

SmokeLoader

Malware Config

C2 Extraction:

http://smk10ddde.com/

Unpacked files

SH256 hash:

c78663af760456420e3e699a22f0eae8dc077e008006eeed6e9a9862bd1e46cd

MD5 hash:

a0416e457f23a51aae303be172cb5dab

SHA1 hash:

96a7bacc74a09455a0026a74b744ffd90b41122b

Link:

https://www.unpac.me/results/aaef933a-2da0-43ac-9363-71a1ac8dec63/

SH256 hash:

640326eaa9b6d1eebecf4925208ea87f31574b530e81b25575a5ab28f23ba90d

MD5 hash:

701f9a4e569369f69ec1c8d2114f5c09

SHA1 hash:

1964037544e248c943177d19b105e3e5594ca53f

Link:

https://www.unpac.me/results/aaef933a-2da0-43ac-9363-71a1ac8dec63/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.