MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d9523a6b90a7ff46fe28f9b9dc280b59f467edc8a8b2a854a12fd40cd3778580. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	d9523a6b90a7ff46fe28f9b9dc280b59f467edc8a8b2a854a12fd40cd3778580
SHA3-384 hash:	cf976b1794fbb907d93a4cbf24c47d5ba2efec35d0a5cd57acd7877a06458b7fdf54d10cb1d29661527b4c0d693d4f0c
SHA1 hash:	d8937d49dc4abf17bba5dc1d48e91e8396f38608
MD5 hash:	0dc2ff8a3b0238fd0d1f18edee2a9630
humanhash:	glucose-december-friend-winter
File name:	SecuriteInfo.com.Generic.mg.0dc2ff8a3b0238fd.13419
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	168'448 bytes
First seen:	2020-08-25 19:36:24 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	d6bba3b065eadc7ae879901510d750ce (1 x Smoke Loader)
ssdeep	3072:rI0Lh/EZwT0s5pYo9LiqkK5nYIfjQifmHPR8j/TVsPH6:008ZXyYo9VkaYWjQi+PRK/yf6
TLSH	52F38B22BFA1D033D4226570A8F4C2B1362FBC719A3DC54BFB451B6A1E312F25A7535A
Reporter	SecuriteInfoCom
Tags:	Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/50723/

Detection(s):

SecuriteInfo.com.Generic.mg.0dc2ff8a3b0238fd.13419.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Sending a UDP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Connection attempt

Sending an HTTP POST request

Deleting of the original file

Enabling autorun by creating a file

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

72 / 100

Link:

https://www.joesandbox.com/analysis/449998

Signature

Antivirus / Scanner detection for submitted sample

Binary contains a suspicious time stamp

Detected unpacking (changes PE section rights)

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d9523a6b90a7ff46fe28f9b9dc280b59f467edc8a8b2a854a12fd40cd3778580/

Threat name:

Win32.Backdoor.Quakbot

Status:

Malicious

First seen:

2020-08-25 17:27:27 UTC

AV detection:

26 of 29 (89.66%)

Threat level:

5/5

Verdict:

unknown

Result

Malware family:

n/a

Score:

10/10

Tags:

n/a

Link:

https://tria.ge/reports/200825-cvhkyjgqxx/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Program crash

Loads dropped DLL

Suspicious use of NtCreateProcessExOtherParentProcess

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Kryptik

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d9523a6b90a7ff46fe28f9b9dc280b59f467edc8a8b2a854a12fd40cd3778580

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.