MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e79f148128e425bd5353039f515bd64a9b562ac0897306d81dad0b529ffbea3a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 16


Intelligence 16 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e79f148128e425bd5353039f515bd64a9b562ac0897306d81dad0b529ffbea3a
SHA3-384 hash: fb1b008768c9a97bb18089c762e0959eb5bb3480c2ab3296b479034e77b0e6f8b337b1504763fb91cd94ccf40af5a7e9
SHA1 hash: 7862bae410d24038d10f063171feff344ebc8e8d
MD5 hash: 546070f6e9ef6342316e9321bb3f821e
humanhash: river-artist-alaska-high
File name:sotema_2.txt
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:352'768 bytes
First seen:2023-01-22 23:14:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4714f79351940b168a490baaf0e169ad (3 x Smoke Loader, 2 x Glupteba, 2 x RedLineStealer)
ssdeep 6144:qr5UYazfL6sMnkhwTHXutZlGFqxmpJEm3LWK2vrZbYsNkF:oUzzfL6pnNTHXutzGFnWOKv9zN
Threatray 15'500 similar samples on MalwareBazaar
TLSH T145749D00A6A1C035F6B212F88976E36C953E7EB15F7040CB52E5EAEE1A346E1EC31717
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10523/12/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon ead8a89cc6e68ee0 (43 x RaccoonStealer, 31 x RedLineStealer, 20 x Smoke Loader)
Reporter jstrosch
Tags:exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
185
Origin country :
US US
Vendor Threat Intelligence
Malware family:
socelars
Create hunting rule
ID:
1
File name:
HEUR-Trojan.Win32.Agent.gen-7a4df2fc82c0b553d.exe
Verdict:
Malicious activity
Analysis date:
2023-01-19 03:02:04 UTC
Tags:
evasion trojan socelars stealer loader amadey rat redline
Link:
https://app.any.run/tasks/fa598afc-e968-40fd-a724-acdc1ef44e2f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
SmokeLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/355716/
Detection(s):
Win.Packed.Generic-9874443-0
Create hunting rule

Win.Packed.Generic-9882417-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Sending a custom TCP request
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Sending an HTTP POST request
Query of malicious DNS domain
Unauthorized injection to a system process
Enabling autorun by creating a file
Sending an HTTP POST request to an infection source
Sending an HTTP GET request to an infection source
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/62337/overview
Behaviour
MalwareBazaar
SystemUptime
MeasuringTime
CPUID_Instruction
EvasionGetTickCount
EvasionQueryPerformanceCounter
CheckCmdLine
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
azorult glupteba greyware mokes packed racealer
Link:
https://www.filescan.io/uploads/63cdc3782d4f6d560e226182/reports/bd30a53c-4e9d-479b-aed5-f4e696cb8019/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/d121b67d-1606-4d33-885b-a289b53644a3
Result
Threat name:
SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1156651
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
DLL reload attack detected
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Renames NTDLL to bypass HIPS
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses an obfuscated file name to hide its real file extension (double extension)
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 789383 Sample: sotema_2.txt.exe Startdate: 23/01/2023 Architecture: WINDOWS Score: 100 29 Multi AV Scanner detection for domain / URL 2->29 31 Malicious sample detected (through community Yara rule) 2->31 33 Antivirus detection for URL or domain 2->33 35 7 other signatures 2->35 6 sotema_2.txt.exe 1 2->6         started        10 fbrbtsv 1 2->10         started        process3 file4 17 C:\Users\user\AppData\Local\Temp\CC4F.tmp, PE32 6->17 dropped 37 DLL reload attack detected 6->37 39 Detected unpacking (changes PE section rights) 6->39 41 Renames NTDLL to bypass HIPS 6->41 49 3 other signatures 6->49 12 explorer.exe 5 8 6->12 injected 43 Antivirus detection for dropped file 10->43 45 Multi AV Scanner detection for dropped file 10->45 47 Machine Learning detection for dropped file 10->47 signatures5 process6 dnsIp7 23 howdycash.com 204.11.56.48, 49719, 80 CONFLUENCE-NETWORK-INCVG Virgin Islands (BRITISH) 12->23 25 twcamel.com 206.119.99.162, 49717, 80 COGENT-174US United States 12->25 27 5 other IPs or domains 12->27 19 C:\Users\user\AppData\Roaming\fbrbtsv, PE32 12->19 dropped 21 C:\Users\user\...\fbrbtsv:Zone.Identifier, ASCII 12->21 dropped 51 System process connects to network (likely due to code injection or exploit) 12->51 53 Benign windows process drops PE files 12->53 55 Deletes itself after installation 12->55 57 Hides that the sample has been downloaded from the Internet (zone.identifier) 12->57 file8 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e79f148128e425bd5353039f515bd64a9b562ac0897306d81dad0b529ffbea3a/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2021-06-25 01:09:06 UTC
File Type:
PE (Exe)
Extracted files:
33
AV detection:
24 of 26 (92.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=46prjaji4qs32u2taopvcw6wjknvmkwarfzqnwa5vufvfh735i5a._file
Verdict:
malicious
Similar samples:
20e1bc5813941642186774cd0aa40989c3d119d7a70b7a6be5d3d8df6185c020
Smoke Loader
73f11644396315366c3d6de45ae19f36f0eb611c0b5ff51c1c34ff44c36276d7
Smoke Loader
7835357865286406888cc157877e88663f7cf3364f3870c94bb7eb8f04cdb22b
Smoke Loader
7df446ede9c1db56f1196ae9dae181054f5b5970711d9bc6705cede1d804ef1a
Smoke Loader
9265b09595c59007e116c60605c28bd616387cf0dff79c7db8c5880e23cfef8e
Smoke Loader
e47bfa7b58706edeeaf73664039c10cb1ff7a517d833c0b28751b835bdc68cf7
Smoke Loader
e6ea98b046b11a35efa0ac1243f6190ff4d4247a35784e65a9feaaf4918ae779
Smoke Loader
e99b9bc72e89c2d22907ec12d2d7939ab4ff487630617e5560fedd89bb467685
Smoke Loader
f361d46f9c3951b20ab5b2a72f5aaef9c4fa4686877a2070876a4b58e07f5e01
Smoke Loader
+ 15'490 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor trojan
Link:
https://tria.ge/reports/230122-28j1xsab46/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Loads dropped DLL
Detects Smokeloader packer
SmokeLoader
Unpacked files
SH256 hash:
fcb8d43635aa485c8b25f1140ba4e56f6f0cbf3054d5dedc96a851d4731a2a6f
MD5 hash:
695c2eff3b7705b6a2d4d25a2692c132
SHA1 hash:
73c2dffcf2e7170d8bfda8cc7282b2bf7bb5f199
Detections:
win_smokeloader_a2
Create hunting rule
SmokeLoaderStage2
Create hunting rule
Link:
https://www.unpac.me/results/53d24abe-0736-488e-a8f8-408a1c4c34e4/
Parent samples :
1dcab4cdffdf269ea33719990ac81c515345b50fe1c60a3fe7e47d1a59fb7cc0
1a27e7943700b31774ab4347b5d2f92be9a50b8a7daeab5b066a0af53c11cdec
3e0c3d945255efa34ae84ba50f144ed86d2f23e451a6695e3c9120dc57632a3d
c5bf77877c8b8254ff63320397401444788b6ffcf7b0f7d4c31fef2d02132e4d
a62e5c321acf5b890bd7a235ea62b8a4061e9ceb1273310ac5ccae57d583cc5e
7a4df2fc82c0b553d0b703f51635fd62cf02553706f942c66d752c1d8fae207b
e79f148128e425bd5353039f515bd64a9b562ac0897306d81dad0b529ffbea3a
SH256 hash:
e79f148128e425bd5353039f515bd64a9b562ac0897306d81dad0b529ffbea3a
MD5 hash:
546070f6e9ef6342316e9321bb3f821e
SHA1 hash:
7862bae410d24038d10f063171feff344ebc8e8d
Link:
https://www.unpac.me/results/53d24abe-0736-488e-a8f8-408a1c4c34e4/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e79f148128e4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e79f148128e425bd5353039f515bd64a9b562ac0897306d81dad0b529ffbea3a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/355716/

Comments