MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dcd09b13e19a92b884cb28ba68a979c7f0ebb5426646a4621573eed16d5582fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	dcd09b13e19a92b884cb28ba68a979c7f0ebb5426646a4621573eed16d5582fb
SHA3-384 hash:	c03f3b22a7e172673c125f3f5188753b65ca3aff567aa06c298e7ab5004bdd4fb6a186fc4af831fda841abb315e53a44
SHA1 hash:	fb5f4ca937732cce3ca4a5dfc161e14066145603
MD5 hash:	f1def32c04f93007b96a99b5a00a6d2c
humanhash:	stream-ohio-artist-blue
File name:	f1def32c04f93007b96a99b5a00a6d2c.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	359'424 bytes
First seen:	2020-11-11 08:09:56 UTC
Last seen:	2020-11-11 09:47:10 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	957f451a9a7944a1fbdb8d7ab72b6645 (5 x Smoke Loader)
ssdeep	6144:aTVeD4mJppgXLo2hA6w12UjXG2KQiw0c53:+MD4CpgXvhA58s0
TLSH	BF74AE51329DC3F1E5E60578447CF3A51ABAB8750B204ACB6B84277E1F362D29A3A347
Reporter	abuse_ch
Tags:	exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

PUA.Win.Downloader.Firseria-6804617-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a file in the %temp% directory

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Sending an HTTP POST request

Sending a custom TCP request

Creating a process from a recently created file

Creating a window

Launching a process

Searching for the window

Sending an HTTP GET request

Reading critical registry keys

Setting browser functions hooks

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Unauthorized injection to a system process

Deleting of the original file

Enabling autorun by creating a file

Unauthorized injection to a browser process

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

CobaltStrike SmokeLoader

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/529967

Signature

Benign windows process drops PE files

Binary contains a suspicious time stamp

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to detect sleep reduction / modifications

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (creates a PE file in dynamic memory)

Detected unpacking (overwrites its own PE header)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Renames NTDLL to bypass HIPS

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Writes to foreign memory regions

Yara detected CobaltStrike

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dcd09b13e19a92b884cb28ba68a979c7f0ebb5426646a4621573eed16d5582fb/

Threat name:

Win32.Trojan.Glupteba

Status:

Malicious

First seen:

2020-11-11 08:10:08 UTC

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor spyware trojan

Link:

https://tria.ge/reports/201111-p5vy5gbjca/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of UnmapMainImage

Program crash

Suspicious use of SetThreadContext

Deletes itself

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

SmokeLoader

Malware Config

C2 Extraction:

http://smk10ddde.com/

Unpacked files

SH256 hash:

dcd09b13e19a92b884cb28ba68a979c7f0ebb5426646a4621573eed16d5582fb

MD5 hash:

f1def32c04f93007b96a99b5a00a6d2c

SHA1 hash:

fb5f4ca937732cce3ca4a5dfc161e14066145603

Link:

https://www.unpac.me/results/1e25ee6a-4a17-4a73-86b0-ca13b4d42d85/

SH256 hash:

640326eaa9b6d1eebecf4925208ea87f31574b530e81b25575a5ab28f23ba90d

MD5 hash:

701f9a4e569369f69ec1c8d2114f5c09

SHA1 hash:

1964037544e248c943177d19b105e3e5594ca53f

Link:

https://www.unpac.me/results/1e25ee6a-4a17-4a73-86b0-ca13b4d42d85/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.