MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa7483411df6daa9d8d2a295d34f70fda480cba9c50a42ac23bdcfcc12bb8dc5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 8

Intelligence 8 IOCs YARA File information Comments

SHA256 hash:	fa7483411df6daa9d8d2a295d34f70fda480cba9c50a42ac23bdcfcc12bb8dc5
SHA3-384 hash:	1b056a20dca5ec8af4c34aea66cd8ff91e4ec92b127ed6b2003284043a9c883e5d18eb7aa6ed589d7afb2a2dd1b29f0e
SHA1 hash:	52566f22c8d7f0df9eb15fe9d213b2c95174b440
MD5 hash:	abf3f27bd68b82d25bd45a1791f92f0a
humanhash:	steak-connecticut-island-london
File name:	abf3f27bd68b82d25bd45a1791f92f0a.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	184'320 bytes
First seen:	2021-08-13 14:28:18 UTC
Last seen:	2021-08-13 16:08:39 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	8dcae17739f93a54640d82b608ad24e8 (4 x RaccoonStealer, 4 x Smoke Loader, 3 x RedLineStealer)
ssdeep	3072:4CLfs/WwaeUQungr6RMwwdlDrNrRNEVR08a4ROjMCCZA9:4CLfKl4RIlZrXOROjMCCi
Threatray	994 similar samples on MalwareBazaar
TLSH	T1A704ADD27993C47EC191D5F048658AB51725FC602A19018FB6987F2F2E332E392FE2D6
dhash icon	4839b2b4e8c38890 (137 x RaccoonStealer, 37 x Smoke Loader, 30 x RedLineStealer)
Reporter	abuse_ch
Tags:	Dofoil exe Smoke Loader

Intelligence

File Origin

# of uploads :

# of downloads :

380

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

abf3f27bd68b82d25bd45a1791f92f0a.exe

Verdict:

No threats detected

Analysis date:

2021-08-13 14:28:41 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/84e13f5a-01d7-4c19-9c79-8839c869f3bb

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RedLine

Link:

https://www.capesandbox.com/analysis/179001/

Detection(s):

SecuriteInfo.com.Trojan.Carberp.2823.31519.18881.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Connection attempt to an infection source

Sending a UDP request

Creating a file in the %temp% directory

Creating a process from a recently created file

Launching the default Windows debugger (dwwin.exe)

Launching a process

Searching for the window

Reading critical registry keys

Setting browser functions hooks

Query of malicious DNS domain

Unauthorized injection to a system process

Sending a TCP request to an infection source

Deleting of the original file

Enabling autorun by creating a file

Sending an HTTP POST request to an infection source

Sending an HTTP GET request to an infection source

Unauthorized injection to a browser process

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Gathering data

Result

Threat name:

Raccoon SmokeLoader

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/832489

Signature

Antivirus detection for URL or domain

Benign windows process drops PE files

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to inject code into remote processes

Contains functionality to steal Internet Explorer form passwords

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

System process connects to network (likely due to code injection or exploit)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Mail credentials (via file access)

Writes to foreign memory regions

Yara detected Raccoon Stealer

Yara detected SmokeLoader

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fa7483411df6daa9d8d2a295d34f70fda480cba9c50a42ac23bdcfcc12bb8dc5/

Threat name:

Win32.Ransomware.StopCrypt

Status:

Malicious

First seen:

2021-08-13 09:34:26 UTC

AV detection:

33 of 46 (71.74%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=7j2igqi563nktwgsukk5gt3q7wsibs5jyufeflbdxxh4yev3rxcq._file

Verdict:

suspicious

Smoke Loader

33a4297298b2ca7b92d4462884eb53abda20d500998e1edb4bc8e7cb646bba1f

Smoke Loader

352d461ee47bb9c6618eb86b1e8b10721c0b0dfd4a4b3e85dfb939f6d101e942

Smoke Loader

512de97a605158b2b306c071919c57ef39553385a38b4ac9b31225ecea2a4951

Smoke Loader

654e5fbb0f6165cdad48fd843ec274d63507133e0f27dab5b535efa1b56b0125

Smoke Loader

776124547155ae68a2dac2b106f6aa8d39b2e71a3b11ca6241a7e305fa03605a

Smoke Loader

c8dc6ed0d081d67f6b686a19ca7f5e211eb502dec5b287cd85b6a37035f20bd7

Smoke Loader

cc700e4575649a012895b044f54ba9b8e87ea47efdeb755f32f135317451610d

Smoke Loader

efe21ec3a8118e21388c0dde6a40257e44ed807b020f1d6921d83a41cfede454

Smoke Loader

f24a559e79ba3121c7e0fed4ac995da056fe6a0dac71b2360f9e340b97117d05

Smoke Loader

+ 984 additional samples on MalwareBazaar

Result

Malware family:

smokeloader

Score:

10/10

Tags:

family:raccoon family:smokeloader botnet:471c70de3b4f9e4d493e418d1f60a90659057de0 botnet:cd8dc1031358b1aec55cc6bc447df1018b068607 backdoor discovery evasion persistence spyware stealer trojan

Link:

https://tria.ge/reports/210813-zdd6gl3a8j/

Behaviour

Checks SCSI registry key(s)

Delays execution with timeout.exe

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Program crash

Suspicious use of SetThreadContext

Adds Run key to start application

Checks installed software on the system

Deletes itself

Drops startup file

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Defender Real-time Protection settings

Raccoon

Raccoon Stealer Payload

SmokeLoader

Suspicious use of NtCreateProcessExOtherParentProcess

Malware Config

C2 Extraction:

http://readinglistforjuly1.xyz/
http://readinglistforjuly2.xyz/
http://readinglistforjuly3.xyz/
http://readinglistforjuly4.xyz/
http://readinglistforjuly5.xyz/
http://readinglistforjuly6.xyz/
http://readinglistforjuly7.xyz/
http://readinglistforjuly8.xyz/
http://readinglistforjuly9.xyz/
http://readinglistforjuly10.xyz/
http://readinglistforjuly1.site/
http://readinglistforjuly2.site/
http://readinglistforjuly3.site/
http://readinglistforjuly4.site/
http://readinglistforjuly5.site/
http://readinglistforjuly6.site/
http://readinglistforjuly7.site/
http://readinglistforjuly8.site/
http://readinglistforjuly9.site/
http://readinglistforjuly10.site/
http://readinglistforjuly1.club/
http://readinglistforjuly2.club/
http://readinglistforjuly3.club/
http://readinglistforjuly4.club/
http://readinglistforjuly5.club/
http://readinglistforjuly6.club/
http://readinglistforjuly7.club/
http://readinglistforjuly8.club/
http://readinglistforjuly9.club/
http://readinglistforjuly10.club/

Dropper Extraction:

http://193.56.146.55/Api/GetFile2