MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce6bf312014f9bb28d9007d7eedb0c455f3bc98196d55955590b7a7af164612a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 9

Intelligence 9 IOCs YARA File information Comments

SHA256 hash:	ce6bf312014f9bb28d9007d7eedb0c455f3bc98196d55955590b7a7af164612a
SHA3-384 hash:	ba5a2c85a9f8482965c18f58e6969089c186bdf44efc3bdd61ac59d86f06d2328880aa414eaaa694277d6fdc301041ff
SHA1 hash:	92e555d09c6ab494518482e825c9a54314a7527e
MD5 hash:	a09a430e59106b44d98395a59985c8a2
humanhash:	cat-pluto-india-mirror
File name:	a09a430e59106b44d98395a59985c8a2.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	279'040 bytes
First seen:	2021-08-25 15:26:02 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	1d03ad9b9e9a9068c266e5f5e715b4b7 (4 x Smoke Loader, 2 x RaccoonStealer, 1 x FickerStealer)
ssdeep	6144:yC6Rk4sGi/q3clELc0y1H6sjabmw8ysYpVbEPq96TpUKD:7mi/qysg1H6s+mWs4Sq0
Threatray	3'604 similar samples on MalwareBazaar
TLSH	T1F7548C30BA91C034F5B252F855B683BCA93A7AB16B7450CF53E526EE06346E4EC30B57
dhash icon	ead8ac9cc6e68ee0 (118 x RaccoonStealer, 102 x RedLineStealer, 46 x Smoke Loader)
Reporter	abuse_ch
Tags:	Dofoil exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

1'230

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

a09a430e59106b44d98395a59985c8a2.exe

Verdict:

Suspicious activity

Analysis date:

2021-08-25 15:33:20 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/9e3aa529-623d-40dc-9248-1e47511b431f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/182351/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Connection attempt

Creating a process from a recently created file

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Deleting of the original file

Enabling autorun by creating a file

Unauthorized injection to a system process

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3d9fe449-3c60-461a-9bc9-fd3f9f0d5574

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/839187

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Performs DNS queries to domains with low reputation

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to resolve many domain names, but no domain seems valid

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ce6bf312014f9bb28d9007d7eedb0c455f3bc98196d55955590b7a7af164612a/

Threat name:

Win32.Trojan.Sabsik

Status:

Malicious

First seen:

2021-08-25 15:26:14 UTC

AV detection:

17 of 46 (36.96%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=zzv7geqbj6n3fdmqa7l65wymivptxsmbs3kvsvkzbn5hv4lemeva._file

Verdict:

suspicious

Smoke Loader

5152274dbe1cc44da156f29d1ff2858e583237bdc24ced137265cd3668ba851e

Smoke Loader

5fc5ab3f922510924c13f1018ba4d5d94f990f3885da41d68a38603020cf9b27

Smoke Loader

608248c1ef7bab54f8a7aeffaf618187a6f20d3bc829a6c6de625e2a2a376f2b

Smoke Loader

92e576963128d956b98f423af33a3a2395e6a16f7d44855cfc2fff71c0651329

Smoke Loader

a19317b14abc6d4c1294aaaeab29d0ada023dffa37025c839671c193a74fd519

Smoke Loader

b817002c69c6315e116f14d6fe64151577999eb773842f052fb17d9a7413a53c

Smoke Loader

e9abbf811d367cf26f493d72ccd96749e534804ac27d36956dce0484b1440f25

Smoke Loader

+ 3'594 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor trojan

Link:

https://tria.ge/reports/210825-wdd1qnxbzj/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Deletes itself

SmokeLoader

Malware Config

C2 Extraction:

http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/