MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 edabd11de61295e368fb3137c23506d44c468234f20e6f1481469fdd66593449. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 7

Intelligence 7 IOCs YARA File information Comments

SHA256 hash:	edabd11de61295e368fb3137c23506d44c468234f20e6f1481469fdd66593449
SHA3-384 hash:	87364a2aebf0344f88c3a7cc7f976c0a6c03ffc415e7200b5974477f567badaff6026fd43a30d4d8fb26e733eb8abc86
SHA1 hash:	b962f4d8733992e6c6c1c3fcc1db4d5bfeb2daeb
MD5 hash:	20f344690b0df3c1fb6c58e3f198f6c4
humanhash:	arizona-pizza-eight-sink
File name:	20f344690b0df3c1fb6c58e3f198f6c4.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	227'840 bytes
First seen:	2021-08-09 11:50:05 UTC
Last seen:	2021-08-09 13:06:25 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	1f895b3a0f59500cbbe993bee47d382a (2 x Smoke Loader, 1 x CryptBot, 1 x RedLineStealer)
ssdeep	3072:yAfAT4fqnshTL35EttBU+sG1ICYD45+v7YWnWnCNeoBdTPpsb:lqnslJc2hGRYDvsWWCIwVp
Threatray	853 similar samples on MalwareBazaar
TLSH	T1FD24AE313690F872F8674531745EDBA0FB69EC306B60424727997E2E6E332C0577A35A
dhash icon	1032787872767e36 (1 x Smoke Loader)
Reporter	abuse_ch
Tags:	exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

121

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

20f344690b0df3c1fb6c58e3f198f6c4.exe

Verdict:

No threats detected

Analysis date:

2021-08-09 11:52:14 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/5a224e36-b7fd-4587-8976-919577390d81

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/177552/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware1.8369.30513.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Connection attempt

Sending an HTTP POST request

Creating a process from a recently created file

Deleting of the original file

Enabling autorun by creating a file

Unauthorized injection to a system process

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

DanaBot

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/43075316-447e-4794-ae24-2cc1ee323f00

Result

Threat name:

RedLine SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/829270

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses known network protocols on non-standard ports

Yara detected RedLine Stealer

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/edabd11de61295e368fb3137c23506d44c468234f20e6f1481469fdd66593449/

Threat name:

Win32.Trojan.Azorult

Status:

Malicious

First seen:

2021-08-09 11:51:06 UTC

AV detection:

20 of 28 (71.43%)

Threat level:

5/5

Verdict:

suspicious

Smoke Loader

3520dc08a98d3baf50a7ab0057c4f1d8fbbbe97ccb88d8d929cfe0ecd76a858d

Smoke Loader

392e2fc8bcf20d142620a90de7cc2632e86771a38db9b2a67a8809935ef97752

Smoke Loader

3d93d1e45579a47c3a3425fd16319c5a004396a2d98b7cf170ed009dad29c247

Smoke Loader

4958d08fea2f261b0d2208047191e970454f48d951da411a9f665f105e298e93

Smoke Loader

640df13e7605d0fd539eaac1474643d4e6ab2f3519cab2450f9b755778dfac6e

Smoke Loader

67b1a7835687bf5851cf29539b2d0ce90ab30d373edfcf9ee54237026c67df33

Smoke Loader

902f92bdbd5dbdd9534149faa18b00d8b983665820427480c93bead483f32c92

Smoke Loader

96ab0a5a858b541c6e6fc44588405d29f8ba18bf8e8ff4af25b235135bbfd01a

Smoke Loader

f7ae55bd859cda0d7d8e4ecf61f3bc9086aed2cea3aacfdd852ad471fa3c54ff

Smoke Loader

+ 843 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:redline family:smokeloader botnet:sewpalpadin backdoor infostealer trojan

Link:

https://tria.ge/reports/210809-8fxxw5gg36/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Deletes itself

Downloads MZ/PE file

Executes dropped EXE

RedLine

RedLine Payload

SmokeLoader

Malware Config

C2 Extraction:

http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
185.215.113.114:8887