MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 faed8958e332c72282fd257d32a1bbdff45a2859b29ff2d2eb7bcca8812d7478. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Smoke Loader

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	faed8958e332c72282fd257d32a1bbdff45a2859b29ff2d2eb7bcca8812d7478
SHA3-384 hash:	401edae077f652c45e92364ae55474f23f70725b3102c3b68312b784383487213d7e4bd10fd6b80392f80bdedf553c8d
SHA1 hash:	040c056fb1e9f576cbdc4a3afde34c7414a797f4
MD5 hash:	99dcbb894a3747ed547826ed76f2fc93
humanhash:	west-spaghetti-spring-glucose
File name:	doxs.com.exe
Download:	download sample
Signature	Smoke Loader Create hunting rule
File size:	261'632 bytes
First seen:	2020-08-18 13:29:55 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	8a3b57462e234fe6043d1d7b63df00a4 (1 x Smoke Loader)
ssdeep	3072:MERnX5Dju2lN4/8pZIh8kZi5UZ0U0Njh81YriDySciXHeCyX9mI8xePog3ouexif:M2X9jHDy8pZVapCGkWy1iQZog3M2gXC
Threatray	42 similar samples on MalwareBazaar
TLSH	A9449E5AEA12C543F1E60E70F1FDCBA6D5393A306915F42FE3C49BA91A706E1C925323
Reporter	abuse_ch
Tags:	exe Smoke Loader

abuse_ch

Malspam distributing unidentified malware:

From: "Loki Wu" <wuj@jolywood.cn>
Subject: Payment correction copy
Attachment: doxs.com.iso (contains "doxs.com.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/47940/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a window

Creating a file in the %temp% directory

Launching a process

Deleting of the original file

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/faed8958e332c72282fd257d32a1bbdff45a2859b29ff2d2eb7bcca8812d7478/

Threat name:

Win32.Backdoor.Mokes

Status:

Malicious

First seen:

2020-08-18 07:50:29 UTC

AV detection:

22 of 29 (75.86%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7lwyswhdgldsfax5ev6tfin3372fukczwkp7fuxlppgkrajnor4a._file

Verdict:

malicious

Label(s):

trickbot

Smoke Loader

2ba5b16b9ce46066c1122bad1fc5feb3de0743451c6603b98e3d0ffe6f9cc019

Smoke Loader

7c9eba57cb8262a908dc10929cf38b8e4e0af9f5a3f69bdf226b151761580e91

Smoke Loader

95a4cf409c7e7813bfa744598bee2e0e572b2d05ec31622867237ea6dab8a813

Smoke Loader

9b28aa737bbfec90341c6a42e2d44f3308659e4fb9dd42d98a0b46cde7aaed63

Smoke Loader

ab7d156971b4c71bd112c92043ac2fcace480d0032f6303beda28fb2a5001b3d

Smoke Loader

d1c50e90c890f092d4675611d4034a89c102226ca2ec29a46294d22b6f656b78

Smoke Loader

d95b7c505dbb3905f88c71bb1efedfe716a0d65862a622eb932f3d774a07a740

Smoke Loader

e237d6e3b44c0bcacf4eff59f58c8028a48c0675f283adc96490ae6daf645bd7

Smoke Loader

eda68de6706516012cda72a22a1e9e089d85ad324f47768bb982eea97836fd8d

Smoke Loader

+ 32 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/200818-lytd7qz13e/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Program crash

Loads dropped DLL

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Trojan

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/faed8958e332c72282fd257d32a1bbdff45a2859b29ff2d2eb7bcca8812d7478

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.