MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eccd8757ac5a6c34abc69c2251a582a6697d9cbb5af2d8c5f8f8787b3156c3ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eccd8757ac5a6c34abc69c2251a582a6697d9cbb5af2d8c5f8f8787b3156c3ff
SHA3-384 hash: 9cf6c4aab17644115a1be191f25be87ed0660fa43d48663e019969151219dcf8f2440418db7526b451b77c1b478c12b5
SHA1 hash: 66fd8595d0886aa3d0340f16d807454c032e2894
MD5 hash: d7ed51f991b290df327320d3b390d729
humanhash: hotel-alaska-massachusetts-hamper
File name:d7ed51f991b290df327320d3b390d729.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:274'432 bytes
First seen:2021-08-25 11:56:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2d1e5013dd6b871ca263ffc72a0f89a9 (2 x RaccoonStealer, 2 x Smoke Loader, 1 x Stop)
ssdeep 3072:/bzPQ2D4QPHiXQ7Asa5lZd2se/867xK5wEUPV57d7zcy2lqM/XR5mDt5V8SU1sc1:/H484Q6ogt2sA8P5wvd5BaSXVzzsPsJ
Threatray 1'206 similar samples on MalwareBazaar
TLSH T177449D30AA91C035E0B311F895BA87BCB93E79B16B3450CB93D526ED06386E5EC31797
dhash icon ead8ac9cc6e68ee0 (118 x RaccoonStealer, 102 x RedLineStealer, 46 x Smoke Loader)
Reporter abuse_ch
Tags:exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
163
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
d7ed51f991b290df327320d3b390d729.exe
Verdict:
No threats detected
Analysis date:
2021-08-25 12:07:06 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/7a7f2f90-f19b-454f-854a-14e15c77eff6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/182285/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader41.29528.23102.7648.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Connection attempt
Sending an HTTP POST request
Deleting of the original file
Enabling autorun by creating a file
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8776db22-79f4-46db-bd29-4cbfc807f0b2
Result
Threat name:
KPot RedLine SmokeLoader
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/839045
Signature
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Contains functionality to infect the boot sector
Contains VNC / remote desktop functionality (version string found)
Creates a thread in another existing process (thread injection)
Creates autostart registry keys with suspicious names
Deletes itself after installation
Detected unpacking (changes PE section rights)
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Yara detected KPot
Yara detected RedLine Stealer
Yara detected SmokeLoader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 471493 Sample: niO15eMewi.exe Startdate: 25/08/2021 Architecture: WINDOWS Score: 100 46 spinogriz91076299.io 2->46 48 kpotuvorot10.bit 2->48 50 2 other IPs or domains 2->50 76 Multi AV Scanner detection for domain / URL 2->76 78 Found malware configuration 2->78 80 Antivirus detection for URL or domain 2->80 82 7 other signatures 2->82 9 niO15eMewi.exe 2->9         started        12 awrjvht 2->12         started        signatures3 process4 signatures5 98 Detected unpacking (changes PE section rights) 9->98 100 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 9->100 102 Maps a DLL or memory area into another process 9->102 104 Creates a thread in another existing process (thread injection) 9->104 14 explorer.exe 7 9->14 injected 106 Multi AV Scanner detection for dropped file 12->106 108 Machine Learning detection for dropped file 12->108 110 Checks if the current machine is a virtual machine (disk enumeration) 12->110 process6 dnsIp7 56 193.142.59.123, 49718, 49743, 80 HOSTSLICK-GERMANYNL Netherlands 14->56 58 181.57.221.246, 49745, 49748, 49749 TelmexColombiaSACO Colombia 14->58 60 6 other IPs or domains 14->60 38 C:\Users\user\AppData\Roaming\awrjvht, PE32 14->38 dropped 40 C:\Users\user\AppData\Local\Temp\F3A7.exe, PE32 14->40 dropped 42 C:\Users\user\AppData\Local\Temp\C727.exe, PE32 14->42 dropped 44 C:\Users\user\...\awrjvht:Zone.Identifier, ASCII 14->44 dropped 68 System process connects to network (likely due to code injection or exploit) 14->68 70 Benign windows process drops PE files 14->70 72 Deletes itself after installation 14->72 74 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->74 19 4235.exe 2 4 14->19         started        23 C727.exe 15 25 14->23         started        26 F3A7.exe 14->26         started        28 2 other processes 14->28 file8 signatures9 process10 dnsIp11 36 C:\ProgramData\...\33A2E4F0.exe, PE32 19->36 dropped 84 Detected unpacking (changes PE section rights) 19->84 86 Creates autostart registry keys with suspicious names 19->86 30 33A2E4F0.exe 19->30         started        52 185.215.113.29, 49740, 8678 WHOLESALECONNECTIONSNL Portugal 23->52 54 api.ip.sb 23->54 88 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 23->88 90 Machine Learning detection for dropped file 23->90 92 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 23->92 96 2 other signatures 23->96 34 conhost.exe 23->34         started        94 Contains functionality to infect the boot sector 26->94 file12 signatures13 process14 dnsIp15 62 gorokborotun782699.com 173.255.194.134, 49754, 49760, 49763 LINODE-APLinodeLLCUS United States 30->62 64 45.33.18.44, 49757, 49759, 49764 LINODE-APLinodeLLCUS United States 30->64 66 3 other IPs or domains 30->66 112 Detected unpacking (changes PE section rights) 30->112 114 Machine Learning detection for dropped file 30->114 116 Found evasive API chain (trying to detect sleep duration tampering with parallel thread) 30->116 signatures16
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eccd8757ac5a6c34abc69c2251a582a6697d9cbb5af2d8c5f8f8787b3156c3ff/
Threat name:
Win32.Trojan.Sabsik
Create hunting rule
Status:
Malicious
First seen:
2021-08-25 09:31:08 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Verdict:
suspicious
Similar samples:
56e45f6af87cf8505b1d88360f14bf00bca7be5108db4d4283fab4605fca2482
Smoke Loader
640df13e7605d0fd539eaac1474643d4e6ab2f3519cab2450f9b755778dfac6e
Smoke Loader
7efe89836b4c06959a1af18891ff07995f8870f566149e8c537c6f76e2a31a89
Smoke Loader
8f2789b6a628a92f9f6313305b255c405f867c49161bb864263dcfef5a6f712d
Smoke Loader
a9c80fcb24dc9e32be9b5cc6a268de0e8a234f55fb8ecd723739a401f51095b2
Smoke Loader
d554a561d409652e3c6a86e766aab42289270a84f92ff9dd93338d25f31f0309
Smoke Loader
ed2ee1c6c961e1752aa5499c12b3351fd262e61fdebad7e9e56a60ad6ee64408
Smoke Loader
+ 1'196 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader backdoor trojan
Link:
https://tria.ge/reports/210825-qgwcdmx9ra/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of UnmapMainImage
Deletes itself
SmokeLoader
Malware Config
C2 Extraction:
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
Unpacked files
SH256 hash:
18cd8e90fcd46329480f24d43baa489683b3ee2fcd274bf1714947ef307a6ab2
MD5 hash:
f2fecf6872ad4c61a3a506159fddd4fc
SHA1 hash:
28e039eb96dcf58841992280c66433a2bbab8e84
Link:
https://www.unpac.me/results/33d4434f-f9d9-4255-a656-c9054523f8d9/
SH256 hash:
eccd8757ac5a6c34abc69c2251a582a6697d9cbb5af2d8c5f8f8787b3156c3ff
MD5 hash:
d7ed51f991b290df327320d3b390d729
SHA1 hash:
66fd8595d0886aa3d0340f16d807454c032e2894
Link:
https://www.unpac.me/results/33d4434f-f9d9-4255-a656-c9054523f8d9/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/eccd8757ac5a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eccd8757ac5a6c34abc69c2251a582a6697d9cbb5af2d8c5f8f8787b3156c3ff

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe eccd8757ac5a6c34abc69c2251a582a6697d9cbb5af2d8c5f8f8787b3156c3ff

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1559349/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/182285/

Comments