MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ebf3a044246492128aa29dad0c4802f374fe32efb8179da5b9f284dc7e3579a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 11

Intelligence 11 IOCs YARA File information Comments

SHA256 hash:	ebf3a044246492128aa29dad0c4802f374fe32efb8179da5b9f284dc7e3579a4
SHA3-384 hash:	d87b2de037f7434d0d01936e43245c6bb2e743b47c66b9fee7575c96248d63c943f4dd61db132417352720744792e772
SHA1 hash:	1a9ac9a8a513bb799d443441a5d3ebfc411dbdd9
MD5 hash:	304113c3b6c298a62b39809361cf79b6
humanhash:	eighteen-pasta-saturn-maryland
File name:	304113c3b6c298a62b39809361cf79b6.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	279'040 bytes
First seen:	2022-03-28 08:16:15 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	cd8ed96dcf990359020da5c59a04eafe (5 x Stop, 2 x Smoke Loader, 1 x ArkeiStealer)
ssdeep	3072:eVEF7olZxLacy3V6kHXGCjHqC/jwumYRYjrb2l:4oWjawkH2CDDwSYju
Threatray	7'253 similar samples on MalwareBazaar
TLSH	T1BA54CE123A91C833E92352B56812EBB49ABBB83119655ACB3FD4062D9F313D3DF71346
File icon (PE):
dhash icon	5c59da3ce0c1c850 (36 x Stop, 33 x Smoke Loader, 26 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

206

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/258507/

Detection(s):

Win.Packed.Strab-9942213-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Sending an HTTP POST request

Sending a custom TCP request

Sending an HTTP GET request

Searching for synchronization primitives

Сreating synchronization primitives

Unauthorized injection to a system process

Enabling autorun by creating a file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://dragonfly.certego.net/analysis/11762/overview

Behaviour

SystemUptime

MeasuringTime

EvasionGetTickCount

CheckCmdLine

EvasionQueryPerformanceCounter

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware

Link:

https://www.filescan.io/uploads/62416f011f20423948408e8f/reports/c1b72d2f-6e97-4d23-b18d-e6dc3ee9d356/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

STOP Ransomware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ae083470-d79f-42b1-bf93-6ec400a5bf59

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/965612

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Tries to evade debugger and weak emulator (self modifying code)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ebf3a044246492128aa29dad0c4802f374fe32efb8179da5b9f284dc7e3579a4/

Threat name:

Win32.Trojan.Raccrypt

Status:

Malicious

First seen:

2022-03-27 19:54:56 UTC

AV detection:

23 of 26 (88.46%)

Threat level:

5/5

Verdict:

malicious

Smoke Loader

4c96561abea75c95091112fe45a8e9eb79b4a66e3f19494148932ffb87aaa17d

Smoke Loader

4ff32cd7d9a37a73d8c836a7c5a32792281e46b3f2d8a17fd535a4c90fe65680

Smoke Loader

54e3ee54fac434e25c03ded56a4680f1ea40a245d657440ac9c51be7f27ef656

Smoke Loader

97c090248e9c4bff5f867844b21d5637b176eabc32d6ef6013b5dd23e76d8081

Smoke Loader

a37cbddb545f168aa1dbb09433e228e5a956f6d8fbc00fae892a5f047990a71f

Smoke Loader

edc39f88a7ef54af6e85f67335c07e6c782a4c0b63b37babff3dc4aa014eb7ac

Smoke Loader

+ 7'243 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor suricata trojan

Link:

https://tria.ge/reports/220328-j6pvaaddaq/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Suspicious use of SetThreadContext

Deletes itself

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

SmokeLoader

suricata: ET MALWARE Danabot Key Exchange Request

Malware Config

C2 Extraction:

http://coralee.at/upload/
http://ducvietcao.com/upload/
http://biz-acc.ru/upload/
http://toimap.com/upload/
http://bbb7d.com/upload/
http://piratia-life.ru/upload/
http://curvreport.com/upload/
http://viagratos.com/upload/
http://mordo.ru/upload/
http://pkodev.net/upload/