MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e74bc1681d06f6f4ab4f3eafaa576329266891516a23b6e8b96410f1b8578b96. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 8

Intelligence 8 IOCs YARA File information Comments

SHA256 hash:	e74bc1681d06f6f4ab4f3eafaa576329266891516a23b6e8b96410f1b8578b96
SHA3-384 hash:	6da5543bf32e08dbb83291b17fb052b2ca4dcd3fa0a36949ff9f5a3c37370c16d71908cd1233376afc7fc1e024738b98
SHA1 hash:	4daab7f5422fbcf14689aedfa353af3e1d07e64c
MD5 hash:	a19f250d646bde9b47deec9023fd27f1
humanhash:	burger-seven-network-solar
File name:	a19f250d646bde9b47deec9023fd27f1.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	198'656 bytes
First seen:	2021-08-16 17:14:59 UTC
Last seen:	2021-08-16 18:15:46 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	32eca4427f106c548c06ec4f87d7efd7 (4 x Smoke Loader, 1 x RedLineStealer, 1 x RaccoonStealer)
ssdeep	3072:unOp9Oy5MmoJn+6ldzV8Dpw9BN8H2RzQuKT0yB3TG3gbnk/Qvq:u+5MZn+2dzVHDilq3g4/Qv
Threatray	4'898 similar samples on MalwareBazaar
TLSH	T10514CF21B590D573C0960130CCA2FAE15B69BD70EA7E065FF798399F6F302B0566B34A
dhash icon	10367878727e7636 (8 x RaccoonStealer, 4 x Smoke Loader, 2 x DanaBot)
Reporter	abuse_ch
Tags:	exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

150

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

a19f250d646bde9b47deec9023fd27f1.exe

Verdict:

Suspicious activity

Analysis date:

2021-08-16 17:18:49 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/c4b047a0-64b7-468f-9938-87f399cc15b9

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/179643/

Detection(s):

SecuriteInfo.com.Trojan.DownLoader41.14222.21358.5749.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Connection attempt to an infection source

Creating a process from a recently created file

Unauthorized injection to a recently created process

Query of malicious DNS domain

Unauthorized injection to a recently created process by context flags manipulation

Deleting of the original file

Enabling autorun by creating a file

Unauthorized injection to a system process

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

SmokeLoader

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3be96358-92a5-4615-a4f7-86c282f42c95

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/833781

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

System process connects to network (likely due to code injection or exploit)

Tries to resolve many domain names, but no domain seems valid

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e74bc1681d06f6f4ab4f3eafaa576329266891516a23b6e8b96410f1b8578b96/

Threat name:

Win32.Backdoor.Mokes

Status:

Malicious

First seen:

2021-08-16 14:59:14 UTC

AV detection:

18 of 28 (64.29%)

Threat level:

5/5

Verdict:

suspicious

Smoke Loader

1054705d0d7ac38687f44baf1c5840910c3e9886c2139706dee8eaceeb4a7621

Smoke Loader

28b577b09ddd23494aaa0a19ae4e9219562a80a9176b9cfcdd3bb76a59bf4a28

Smoke Loader

33c9743aff75b1eebaef927059a4373de1ed4f8e984735c775cac98c18bdec90

Smoke Loader

341affdc32c116eeac3bc8af74eeec475feb728b9bc8a56a4b35ad4755707d5e

Smoke Loader

39894026621d1c5fabeca0fe3b0ba3fe2e97d99e17d50227ead4ac7c64ee080c

Smoke Loader

ce2fe316faac707fdef9aed79c1eb348f74a538fb5617ceea0a003b964c146e4

Smoke Loader

eaa52f460d64093ebcf267e2fa4ebe342b31ee442127afe065892b790409eb33

Smoke Loader

f3855d49ccbeeadc7d42439f83fa85f02f3383d42b7a8f2ad2d4e29d41f53441

Smoke Loader

+ 4'888 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:raccoon family:redline family:smokeloader botnet:cd8dc1031358b1aec55cc6bc447df1018b068607 backdoor discovery evasion infostealer spyware stealer suricata themida trojan

Link:

https://tria.ge/reports/210816-qrg8m3bw4s/

Behaviour

Checks SCSI registry key(s)

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks whether UAC is enabled

Checks BIOS information in registry

Deletes itself

Loads dropped DLL

Reads user/profile data of web browsers

Themida packer

Downloads MZ/PE file

Executes dropped EXE

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Raccoon Stealer Payload

RedLine

RedLine Payload

SmokeLoader

Suspicious use of NtCreateProcessExOtherParentProcess

suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

Raccoon

Malware Config

C2 Extraction:

http://readinglistforjuly1.xyz/
http://readinglistforjuly2.xyz/
http://readinglistforjuly3.xyz/
http://readinglistforjuly4.xyz/
http://readinglistforjuly5.xyz/
http://readinglistforjuly6.xyz/
http://readinglistforjuly7.xyz/
http://readinglistforjuly8.xyz/
http://readinglistforjuly9.xyz/
http://readinglistforjuly10.xyz/
http://readinglistforjuly1.site/
http://readinglistforjuly2.site/
http://readinglistforjuly3.site/
http://readinglistforjuly4.site/
http://readinglistforjuly5.site/
http://readinglistforjuly6.site/
http://readinglistforjuly7.site/
http://readinglistforjuly8.site/
http://readinglistforjuly9.site/
http://readinglistforjuly10.site/
http://readinglistforjuly1.club/
http://readinglistforjuly2.club/
http://readinglistforjuly3.club/
http://readinglistforjuly4.club/
http://readinglistforjuly5.club/
http://readinglistforjuly6.club/
http://readinglistforjuly7.club/
http://readinglistforjuly8.club/
http://readinglistforjuly9.club/
http://readinglistforjuly10.club/