MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d1abb50ea4d533a3e57b99e347d5d8675896ce23576987edcc9c3426ffb0c380. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 18

Intelligence 18 IOCs YARA 4 File information Comments

SHA256 hash:	d1abb50ea4d533a3e57b99e347d5d8675896ce23576987edcc9c3426ffb0c380
SHA3-384 hash:	d672b0998aa83ae5d2afb0cd061c6cec7fbf84d2faa30b837acd829f3a9c33b3390f57c18a4da9d9b0a4571b335a245b
SHA1 hash:	64736caebb69bab6f2fdd6549c6bec9454d8132d
MD5 hash:	979951c8de45460fff2197797b54aa1e
humanhash:	cardinal-sixteen-lemon-foxtrot
File name:	979951c8de45460fff2197797b54aa1e.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	213'504 bytes
First seen:	2024-08-22 07:13:51 UTC
Last seen:	2024-08-22 07:28:16 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	b0c0038db4971a28ca51e4ef34c2fead (2 x Smoke Loader)
ssdeep	1536:Mb83IHUaGDgtlvQpVCkIPbJqMzxnVYt6/27RSYNHtEKOBLj25kvfB5xPO61N4mDg:MbBFnWwkIjAMznL/2zipzv55o64c6tM
TLSH	T1E1249D2175F1DC32F6FB893678B4A6A51A7BF8522630414F26642F6E1E317E04AF2317
TrID	47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
File icon (PE):
dhash icon	9671e896ccd0d4e4 (1 x Stealc, 1 x Smoke Loader)
Reporter	abuse_ch
Tags:	exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

427

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

979951c8de45460fff2197797b54aa1e.exe

Verdict:

Malicious activity

Analysis date:

2024-08-22 07:20:56 UTC

Tags:

loader smokeloader

Link:

https://app.any.run/tasks/04b33b84-2c74-41e0-a680-7c26410faa18

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.MulDrop28.8655.30163.10536.UNOFFICIAL

Verdict:

Malicious

Score:

94.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=66c6e540e7ff3f5a063bbe27

Tags:

Network Stealth Smoke Loader

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Connection attempt

Sending an HTTP POST request

Unauthorized injection to a system process

Enabling autorun by creating a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-vm epmicrosoft_visual_cc fingerprint microsoft_visual_cc smokeloader

Link:

https://www.filescan.io/uploads/66c6e54076775d4b06734e91/reports/0969d1e9-f557-4a97-b0cf-9579decbdbde/overview

Verdict:

Malicious

Labled as:

Malware

Link:

https://www.hybrid-analysis.com/sample/d1abb50ea4d533a3e57b99e347d5d8675896ce23576987edcc9c3426ffb0c380

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/2b570dab-97a8-4284-af35-de4ce49c15fa

Result

Threat name:

LummaC, Go Injector, LummaC Stealer, Smo

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1497237

Signature

AI detected suspicious sample

Allocates memory in foreign processes

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sample uses string decryption to hide its real strings

Suricata IDS alerts for network traffic

Switches to a custom stack to bypass stack traces

System process connects to network (likely due to code injection or exploit)

Writes to foreign memory regions

Yara detected Go Injector

Yara detected LummaC Stealer

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/d1abb50ea4d533a3e57b99e347d5d8675896ce23576987edcc9c3426ffb0c380

Detection:

smokeloader

Link:

https://mwdb.cert.pl/sample/d1abb50ea4d533a3e57b99e347d5d8675896ce23576987edcc9c3426ffb0c380/

Threat name:

Win32.Trojan.SmokeLoader

Status:

Malicious

First seen:

2024-08-22 06:34:30 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2gv3kdve2uz2hzl3thrupvoym5mjntrdk5uyp3omtq2cn75qyoaa._file

Verdict:

malicious

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader botnet:pub2 backdoor discovery trojan

Link:

https://tria.ge/reports/240822-h2nkzsvbnb/

Behaviour

Checks SCSI registry key(s)

Program crash

System Location Discovery: System Language Discovery

SmokeLoader

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/caf79a26-c476-4fea-b184-650e21457888

Unpacked files

SH256 hash:

977646f31a879d2ddd9938e2f39a74653556fd970dd2fa6172f26348d18622dc

MD5 hash:

8ee858716125555e7355a2b919417a53

SHA1 hash:

20a3bfa728fe21f18f6c4f8c17c01e4bd416063e

Detections:

SmokeLoaderStage2

win_smokeloader_a2

Link:

https://www.unpac.me/results/ad016aba-9cc7-4f48-b0b5-73292ef35960/

Parent samples :

3ec76b58400fa83602d35d82f38341d921223dcdf175b98bca435a59ba340464
d3e138b03be305d34d6ee21c5f4cc4d496ff447601ffb71508e23e580bd50e7c
edf20ee240507ae1f49a20f8d20deee11484c013150d6d57ae1fe8ff69e0f8d5
e75102f75f478c346b1dd2ebd56311a9d7345d3c785a6b2dc2911033a317c485
d1abb50ea4d533a3e57b99e347d5d8675896ce23576987edcc9c3426ffb0c380
acc17deb417db03958118c1ac08156e0fca081605b909644523dd3fa887cf674
88b5ed74d4fc6f2cf6394bd1766f44df61e7dc9b810cfacbecba5b34af3bf57d
76ba1d82e20b13b9d1becbb799aa68f6539092f6823f38a86ce935b0650b0556
41582c8b6bd111a2f141dee52b619d13278ef68754691263abeb3238d485f404
1c1d81eaf1a389d4dafc6ba71a3e3bfaa477a49b4d3591956cab660165648028
1415378411d7d155dd8217cdc7e453dc221219b2432473d110ea65368f58f095

SH256 hash:

d1abb50ea4d533a3e57b99e347d5d8675896ce23576987edcc9c3426ffb0c380

MD5 hash:

979951c8de45460fff2197797b54aa1e

SHA1 hash:

64736caebb69bab6f2fdd6549c6bec9454d8132d

Link:

https://www.unpac.me/results/ad016aba-9cc7-4f48-b0b5-73292ef35960/

Malware family:

SmokeLoader

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d1abb50ea4d5/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d1abb50ea4d533a3e57b99e347d5d8675896ce23576987edcc9c3426ffb0c380

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Active Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

exe d1abb50ea4d533a3e57b99e347d5d8675896ce23576987edcc9c3426ffb0c380

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3112840/

Delivery method

Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetStartupInfoA KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::FillConsoleOutputCharacterA KERNEL32.dll::WriteConsoleOutputA KERNEL32.dll::SetConsoleScreenBufferSize KERNEL32.dll::GetConsoleAliasesLengthW KERNEL32.dll::GetConsoleAliasesLengthA
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateDirectoryW
WIN_BASE_USER_API	Retrieves Account Information	KERNEL32.dll::GetComputerNameA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample