MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef248bae94e9f2e71b1a1a895e4b850edc487f26aaf69bb0aca4124b4adb82ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	ef248bae94e9f2e71b1a1a895e4b850edc487f26aaf69bb0aca4124b4adb82ec
SHA3-384 hash:	a67fdb39a6616ef5f4bf27b629a9d0267f22f373e51dc911e2655e911c16a7159fe686def227378aa6db621c727dac1f
SHA1 hash:	8f2926ffe624c3f7e23521d8ad76daec6e5543f9
MD5 hash:	a34c4bb86bcd69c11eb9c7c9e401f063
humanhash:	massachusetts-aspen-robert-pennsylvania
File name:	a34c4bb86bcd69c11eb9c7c9e401f063.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	287'232 bytes
First seen:	2020-11-11 16:34:46 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	c25051ab6f9bde4873ea577d64187971 (8 x Smoke Loader)
ssdeep	6144:cBWfPhELQ5vLUKR31Smh7dzkwYyq0iw0c:cgfPhELQ5vLwixkd00
Threatray	126 similar samples on MalwareBazaar
TLSH	F254BF2A36B0C0F1C5A61A318474D7A45AFAB87257744ACB37643B6E5F343D0AA7E307
Reporter	abuse_ch
Tags:	exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Win.Packed.Glupteba-9791256-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Deleting of the original file

Enabling autorun by creating a file

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/531232

Signature

Benign windows process drops PE files

Binary contains a suspicious time stamp

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Renames NTDLL to bypass HIPS

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ef248bae94e9f2e71b1a1a895e4b850edc487f26aaf69bb0aca4124b4adb82ec/

Threat name:

Win32.Trojan.Glupteba

Status:

Malicious

First seen:

2020-11-11 16:38:16 UTC

AV detection:

26 of 29 (89.66%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=54sixluu5hzoogy2dkev4s4fb3oeq7zgvl3jxmfmuqjewsw3qlwa._file

Verdict:

suspicious

Smoke Loader

2c10f6776795d59fe038ed6b7ff9e2d1a710a027a35845e34e4cd5fef17892f8

Smoke Loader

2e8088a31e158e71911322a9fda5eaf609616e574d76932f849cc55f2c184211

Smoke Loader

4f86f65a5437398451da41f7fb8a99dc4b11b39899a3cb73198b814cf7e15101

Smoke Loader

51b64f2828c607dc4ef107428363fe9ad51e09c10e5778537bcf1ffc4c380a23

Smoke Loader

76fe343785baa82890e56eafb11c61b0422e7a7820601d3795fd87ec972fba52

Smoke Loader

810054919862bbf27f86e170be95aa80bc516a99704fc46103f24905a8099401

Smoke Loader

860ce43cef0bbd5b0447f02c55a6c0827aa09e3b7d537b1167bd67047980ab93

Smoke Loader

ab3cdb12407fd462c852a5d4565dfde55ff3baaf019f99125970d4355c238a09

Smoke Loader

efa0b8e5a18bc36c173b2b891b7df7dc3b5419c115adb3952c951219a282d25d

Smoke Loader

+ 116 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor trojan

Link:

https://tria.ge/reports/201111-j1pw5pbkgs/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of UnmapMainImage

Deletes itself

Loads dropped DLL

SmokeLoader

Malware Config

C2 Extraction:

http://smk10ddde.com/

Unpacked files

SH256 hash:

ef248bae94e9f2e71b1a1a895e4b850edc487f26aaf69bb0aca4124b4adb82ec

MD5 hash:

a34c4bb86bcd69c11eb9c7c9e401f063

SHA1 hash:

8f2926ffe624c3f7e23521d8ad76daec6e5543f9

Link:

https://www.unpac.me/results/57a85f49-0b25-4846-aa46-ab24e2e8f1e5/

SH256 hash:

640326eaa9b6d1eebecf4925208ea87f31574b530e81b25575a5ab28f23ba90d

MD5 hash:

701f9a4e569369f69ec1c8d2114f5c09

SHA1 hash:

1964037544e248c943177d19b105e3e5594ca53f

Link:

https://www.unpac.me/results/57a85f49-0b25-4846-aa46-ab24e2e8f1e5/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.