MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d49c85eb752165255e0f2c984c14e569b04a46efc1b842c7f2da3a900ec43aa6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d49c85eb752165255e0f2c984c14e569b04a46efc1b842c7f2da3a900ec43aa6
SHA3-384 hash: 22636f7eeb094bd0c34ff9cf9430037b53eb0b8bb1668a72d03298a1f246e641ceba14327bedd9b4669ebc5a1da4458d
SHA1 hash: 1ea60c79020579c29b137a1cfa4adf4522dba244
MD5 hash: 6e331d589b1b6b35fa27633c6ec9fb24
humanhash: delta-delaware-pip-steak
File name:SecuriteInfo.com.W32.AIDetect.malware1.7166.26003
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:210'432 bytes
First seen:2021-08-11 11:55:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4b405a935ba1896da801696a6c1a4ade (6 x RaccoonStealer, 4 x Smoke Loader, 1 x ArkeiStealer)
ssdeep 3072:KmLQ4HldnoWomeu0W8KDB5YzwLzLScsYh6gSVywo3c+:FtnoWtf0Laa7knGyHM
Threatray 2'612 similar samples on MalwareBazaar
TLSH T1DD24AD313DB8D9B2D4951530C862CBE46A2FFD61BA6405473B983B6FEE303D1166A34A
dhash icon 4839b2b4e8c38890 (137 x RaccoonStealer, 37 x Smoke Loader, 30 x RedLineStealer)
Reporter SecuriteInfoCom
Tags:exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.W32.AIDetect.malware1.7166.26003
Verdict:
Malicious activity
Analysis date:
2021-08-11 11:59:11 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/73345152-17bb-4a84-af01-4b20b693eba5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/178217/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.7166.26003.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %AppData% subdirectories
Launching a process
Sending a UDP request
Creating a process from a recently created file
Enabling autorun by creating a file
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
DanaBot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c81a46c0-51b0-4307-8734-e2789a87f4d0
Result
Threat name:
Clipboard Hijacker
Create hunting rule
Detection:
malicious
Classification:
spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/830879
Signature
Contains functionality to compare user and computer (likely to detect sandboxes)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Clipboard Hijacker
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d49c85eb752165255e0f2c984c14e569b04a46efc1b842c7f2da3a900ec43aa6/
Threat name:
Win32.Ransomware.LockbitCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-08-11 11:13:34 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
1b2a01df5ea1d61efe89352a307c4c9c27b9dce72d8a907cdd314c56cd064161
Smoke Loader
1f2ce1ccc581d246535b9d9bb13fc8a91b65c5b41399f0ff2a83cc2fcced5728
Smoke Loader
2542930821438d2ea9aa9b34ad96a1b23118e5c2987990d6608df7271879f6b4
Smoke Loader
2d7abc6173feb17ef4223fc045f35ed18607680b1844dfffcba70351d92626ce
Smoke Loader
67e20fb330a04ed5016a2386014c472ddcdd7fff3d6d739ebe175e7f88861549
Smoke Loader
6d3144225d32e3a562f1c5c449c197027ee44c6ae259755431ff258ec1fba201
Smoke Loader
72aced48c0daeb114c201a6b2268310812c8d674eea9ecf441dd06b32914eb19
Smoke Loader
94d5244c6d029eff0002989cb51a3ec3167217533d3eec2f38aeee74ff5c818e
Smoke Loader
a3b39be8c42e45beedebf1c819fa5f7e3c1f195fe104ddf83c2a12804c2d5a51
Smoke Loader
fa0f85a012c1ad0242bad1ab65f236656c4a6198616d3a6163a6087483733cd6
Smoke Loader
+ 2'602 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/210811-3ypm8r88fx/
Behaviour
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Executes dropped EXE
Unpacked files
SH256 hash:
19189d845acac54398888e27a66eb3771588bbde2080d3d3aab138053aee89e0
MD5 hash:
d850f8d4823240e54f834f85e09bd9e7
SHA1 hash:
2b7d73ebe87cf045464714074b06e756e788d05d
Link:
https://www.unpac.me/results/608df390-4f35-49cb-9156-61c7c3fe1832/
SH256 hash:
d49c85eb752165255e0f2c984c14e569b04a46efc1b842c7f2da3a900ec43aa6
MD5 hash:
6e331d589b1b6b35fa27633c6ec9fb24
SHA1 hash:
1ea60c79020579c29b137a1cfa4adf4522dba244
Link:
https://www.unpac.me/results/608df390-4f35-49cb-9156-61c7c3fe1832/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d49c85eb752165255e0f2c984c14e569b04a46efc1b842c7f2da3a900ec43aa6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MALWARE_Win_SmokeLoader
Create hunting rule
Author:ditekSHen
Description:Detects SmokeLoader variants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe d49c85eb752165255e0f2c984c14e569b04a46efc1b842c7f2da3a900ec43aa6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1524258/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/178217/

Comments