MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f5d6498574e03f954a8b2fed5af8b5bbb4acb1a454ee6da4c9fb6e281f9f4281. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	f5d6498574e03f954a8b2fed5af8b5bbb4acb1a454ee6da4c9fb6e281f9f4281
SHA3-384 hash:	74d013821cd0ed923bef0c15968923f0c42890c97d5fa75e24e6b87a30a60568646c33b63ef817a965fade8a4b987e42
SHA1 hash:	63a9d142a597db63167ff7aa1f6473e4aa296a46
MD5 hash:	7734a15f67a1be7bb7de3ca3fcc050d8
humanhash:	speaker-pip-low-earth
File name:	7734a15f67a1be7bb7de3ca3fcc050d8.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	320'512 bytes
First seen:	2020-11-11 16:42:12 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	7c6af8b42ce4c32de9986426801d66e3 (4 x Smoke Loader)
ssdeep	3072:AAnp0yBh0hEcpuLGMuJV4yRQjYU2U9R3jotQSMsCex7PTiCN0QiqjjjjjjjpuOmV:ASpjh0hVpuLE4P3lPoQSliw0Q9e
Threatray	126 similar samples on MalwareBazaar
TLSH	CF649D2175A0E0F3C1D615315465F7702ABAB86257A449CB3B98EB2E5E303D0EB7A34F
Reporter	abuse_ch
Tags:	exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Win.Dropper.Glupteba-9791492-0

Win.Dropper.Glupteba-9792183-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Deleting of the original file

Enabling autorun by creating a file

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

SmokeLoader

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/531006

Signature

Benign windows process drops PE files

Binary contains a suspicious time stamp

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Renames NTDLL to bypass HIPS

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f5d6498574e03f954a8b2fed5af8b5bbb4acb1a454ee6da4c9fb6e281f9f4281/

Threat name:

Win32.Backdoor.Quakbot

Status:

Malicious

First seen:

2020-11-12 00:21:26 UTC

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6xletblu4a7zksulf7wvv6fvxo2kzmnektxg3jgj7nxcqh47ikaq._file

Verdict:

suspicious

Smoke Loader

2c10f6776795d59fe038ed6b7ff9e2d1a710a027a35845e34e4cd5fef17892f8

Smoke Loader

2e8088a31e158e71911322a9fda5eaf609616e574d76932f849cc55f2c184211

Smoke Loader

4f86f65a5437398451da41f7fb8a99dc4b11b39899a3cb73198b814cf7e15101

Smoke Loader

51b64f2828c607dc4ef107428363fe9ad51e09c10e5778537bcf1ffc4c380a23

Smoke Loader

76fe343785baa82890e56eafb11c61b0422e7a7820601d3795fd87ec972fba52

Smoke Loader

810054919862bbf27f86e170be95aa80bc516a99704fc46103f24905a8099401

Smoke Loader

860ce43cef0bbd5b0447f02c55a6c0827aa09e3b7d537b1167bd67047980ab93

Smoke Loader

ab3cdb12407fd462c852a5d4565dfde55ff3baaf019f99125970d4355c238a09

Smoke Loader

efa0b8e5a18bc36c173b2b891b7df7dc3b5419c115adb3952c951219a282d25d

Smoke Loader

+ 116 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:smokeloader backdoor trojan

Link:

https://tria.ge/reports/201111-zmra5mmemx/

Behaviour

Checks SCSI registry key(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of UnmapMainImage

Deletes itself

Loads dropped DLL

SmokeLoader

Malware Config

C2 Extraction:

http://smk10ddde.com/

Unpacked files

SH256 hash:

f5d6498574e03f954a8b2fed5af8b5bbb4acb1a454ee6da4c9fb6e281f9f4281

MD5 hash:

7734a15f67a1be7bb7de3ca3fcc050d8

SHA1 hash:

63a9d142a597db63167ff7aa1f6473e4aa296a46

Link:

https://www.unpac.me/results/a94da0da-1afc-439b-a5d3-a45b9dc49606/

SH256 hash:

640326eaa9b6d1eebecf4925208ea87f31574b530e81b25575a5ab28f23ba90d

MD5 hash:

701f9a4e569369f69ec1c8d2114f5c09

SHA1 hash:

1964037544e248c943177d19b105e3e5594ca53f

Link:

https://www.unpac.me/results/a94da0da-1afc-439b-a5d3-a45b9dc49606/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.