MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb2e2174a3ec526861932043c1aa5b5e62e3abed0bb73e88e495eab66635e758. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Smoke Loader


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fb2e2174a3ec526861932043c1aa5b5e62e3abed0bb73e88e495eab66635e758
SHA3-384 hash: c11aecbe6c18a7a13a19779a0765415a752678fd7fcc40b0bde5dc20fae1bab87fb1c02099fac0b85ebfef07b26c0da5
SHA1 hash: a1316534bb8a3b52ec4f14d8c3172e49f6c5760f
MD5 hash: e0059c4ad73116bf0ea29d575ea2c175
humanhash: william-zulu-sodium-september
File name:e0059c4ad73116bf0ea29d575ea2c175.exe
Download: download sample
Signature Smoke Loader
Create hunting rule
File size:166'400 bytes
First seen:2021-03-29 07:05:10 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3ecbda6de31890eaa5cd272ab1b192ac (5 x Smoke Loader, 4 x FickerStealer, 3 x RaccoonStealer)
ssdeep 3072:qCSrRmUaOy/LE6vTgr7kuvO72+wrtmGhoG7MqOKe/l0:qCSrROOSLE8MrbvubwRhHVol
Threatray 25 similar samples on MalwareBazaar
TLSH B4F3AE0139D6C473E5A629714874C2F1163AFCB65B2256CB7BC43B6D5F322E28A39B43
Reporter abuse_ch
Tags:Dofoil exe Smoke Loader

Intelligence

File Origin
# of uploads :
1
# of downloads :
435
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
e0059c4ad73116bf0ea29d575ea2c175.exe
Verdict:
Suspicious activity
Analysis date:
2021-03-29 07:12:33 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/c6b1c6e1-2b79-42eb-a8d0-c215b88ecce6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/127471/
Detection(s):
Win.Dropper.Ursnif-9847634-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Connection attempt
Sending an HTTP POST request
Deleting of the original file
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/35a8a27e-da4c-4917-b6e7-f705dca8d8ac
Result
Threat name:
Tofsee Vidar Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/656496
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
Benign windows process drops PE files
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Creates files in alternative data streams (ADS)
Deletes itself after installation
Detected Stratum mining protocol
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops executables to the windows directory (C:\Windows) and starts them
Found many strings related to Crypto-Wallets (likely being stolen)
Found strings related to Crypto-Mining
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Modifies the windows firewall
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Renames NTDLL to bypass HIPS
Sigma detected: Suspicious Svchost Process
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to steal Mail credentials (via file access)
Uses netsh to modify the Windows network and firewall settings
Uses ping.exe to check the status of other devices and networks
Writes to foreign memory regions
Yara detected Tofsee
Yara detected Vidar stealer
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 377180 Sample: InnAcjnAmG.exe Startdate: 29/03/2021 Architecture: WINDOWS Score: 100 82 microsoft-com.mail.protection.outlook.com 2->82 84 app.snapchat.com 2->84 86 4 other IPs or domains 2->86 112 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->112 114 Malicious sample detected (through community Yara rule) 2->114 116 Antivirus detection for URL or domain 2->116 118 11 other signatures 2->118 10 InnAcjnAmG.exe 1 2->10         started        13 nemkupwk.exe 2->13         started        15 dbeeeds 1 2->15         started        signatures3 process4 file5 136 Detected unpacking (changes PE section rights) 10->136 138 Renames NTDLL to bypass HIPS 10->138 140 Maps a DLL or memory area into another process 10->140 142 Creates a thread in another existing process (thread injection) 10->142 18 explorer.exe 8 10->18 injected 144 Detected unpacking (overwrites its own PE header) 13->144 146 Writes to foreign memory regions 13->146 148 Allocates memory in foreign processes 13->148 150 Injects a PE file into a foreign processes 13->150 23 svchost.exe 13->23         started        80 C:\Users\user\AppData\Local\Temp\CC4F.tmp, PE32 15->80 dropped 152 Multi AV Scanner detection for dropped file 15->152 154 Machine Learning detection for dropped file 15->154 156 Checks if the current machine is a virtual machine (disk enumeration) 15->156 signatures6 process7 dnsIp8 88 91.203.5.155, 49760, 80 VOLIA-ASUA Ukraine 18->88 90 junntd.xyz 95.158.162.200, 49729, 49738, 49745 VIDEOSATBG Bulgaria 18->90 96 10 other IPs or domains 18->96 68 C:\Users\user\AppData\Roaming\dbeeeds, PE32 18->68 dropped 70 C:\Users\user\AppData\Local\Temp\8D16.exe, PE32 18->70 dropped 72 C:\Users\user\AppData\Local\Temp\7E12.exe, PE32 18->72 dropped 76 2 other malicious files 18->76 dropped 120 System process connects to network (likely due to code injection or exploit) 18->120 122 Benign windows process drops PE files 18->122 124 Deletes itself after installation 18->124 126 Hides that the sample has been downloaded from the Internet (zone.identifier) 18->126 25 7E12.exe 15 18->25         started        29 8D16.exe 2 18->29         started        32 74BA.exe 16 18->32         started        34 A708.exe 18->34         started        92 5.9.72.48, 431, 49794, 49800 HETZNER-ASDE Germany 23->92 94 185.253.217.20, 431, 49798, 49804 PINDC-ASRU Ukraine 23->94 98 14 other IPs or domains 23->98 74 C:\Windows\SysWOW64\...\systemprofile:.repos, data 23->74 dropped 128 Creates files in alternative data streams (ADS) 23->128 130 Injects a PE file into a foreign processes 23->130 36 svchost.exe 23->36         started        file9 132 Detected Stratum mining protocol 92->132 signatures10 process11 dnsIp12 102 dolboeb1701.com 8.208.95.18, 49772, 49775, 80 CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC Singapore 25->102 104 bdns.by 88.80.20.20, 443, 49753 PRQ-AS________________________SE Sweden 25->104 158 Multi AV Scanner detection for dropped file 25->158 160 Detected unpacking (changes PE section rights) 25->160 162 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 25->162 174 2 other signatures 25->174 38 cmd.exe 25->38         started        78 C:\Users\user\AppData\Local\...\nemkupwk.exe, PE32 29->78 dropped 164 Detected unpacking (overwrites its own PE header) 29->164 166 Machine Learning detection for dropped file 29->166 168 Uses netsh to modify the Windows network and firewall settings 29->168 170 Modifies the windows firewall 29->170 41 cmd.exe 2 29->41         started        44 netsh.exe 3 29->44         started        46 cmd.exe 1 29->46         started        50 3 other processes 29->50 106 data.parafia-strumiany.pl 157.90.227.5, 80 REDIRISRedIRISAutonomousSystemES United States 32->106 108 api.faceit.com 104.17.63.50, 443, 49757 CLOUDFLARENETUS United States 32->108 110 msr.pool-pay.com 176.9.119.47, 49823, 6199 HETZNER-ASDE Germany 36->110 172 System process connects to network (likely due to code injection or exploit) 36->172 48 conhost.exe 36->48         started        file13 signatures14 process15 dnsIp16 100 127.0.0.1 unknown unknown 38->100 52 conhost.exe 38->52         started        54 PING.EXE 38->54         started        134 Uses ping.exe to check the status of other devices and networks 41->134 56 conhost.exe 41->56         started        58 conhost.exe 44->58         started        60 conhost.exe 46->60         started        62 conhost.exe 50->62         started        64 conhost.exe 50->64         started        66 conhost.exe 50->66         started        signatures17 process18
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fb2e2174a3ec526861932043c1aa5b5e62e3abed0bb73e88e495eab66635e758/
Threat name:
Win32.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-03-28 11:41:12 UTC
AV detection:
26 of 48 (54.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7mxcc5fd5rjgqymtebb4dks3lzrohk7nbo3t5chesxvlmzrv45ma._file
Verdict:
malicious
Similar samples:
1c259208bdea5d896335c7a22d7a3048e4cfe0c7578a466f8faad880446f4e02
Smoke Loader
281de330768f7e2231f3984b2fbac04bf9f7f2b2d4fb3c2f91d6ba2eab8d546c
Smoke Loader
6feed7d5f7d9776c69963076fdb46de01b8ff9253a84b9e086e0beefc85a181d
Smoke Loader
99ddbc06f3ec84f50661bb88036fd872308af6f5841a9730cc020c5b7467a3c0
Smoke Loader
b7de56f8c1d25037dbded37355d0cd8219f68d38683913de1e000c2c50159143
Smoke Loader
bac4a89d948dc9dce4b4b3c2a6bad222a052c6a3a5a4190e0a61cdf46b4c22c7
Smoke Loader
bb338ad009e5f738ff8e482959c3af1fd0d9d68864e8a5574087d53b427aee76
Smoke Loader
cd291b0afa870e36bcd70dfc9c4db4cd0d82ddc5b110bfc0ddd644455174b39a
Smoke Loader
ed545d941919632591e31377799e17181448dc29acb80d9bca885a1995a00057
Smoke Loader
f69bdd82ca22268d090832707e37b1cae408ba96476843b55feedac11acc6277
Smoke Loader
+ 15 additional samples on MalwareBazaar
Result
Malware family:
tofsee
Create hunting rule
Score:
  10/10
Tags:
family:smokeloader family:taurus_stealer family:tofsee backdoor bootkit discovery evasion persistence spyware stealer trojan
Link:
https://tria.ge/reports/210329-grqc5qt2g2/
Behaviour
Checks SCSI registry key(s)
Delays execution with timeout.exe
Modifies data under HKEY_USERS
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Launches sc.exe
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Accesses 2FA software files, possible credential harvesting
Adds Run key to start application
Checks installed software on the system
Checks whether UAC is enabled
Looks up external IP address via web service
Writes to the Master Boot Record (MBR)
Checks BIOS information in registry
Deletes itself
Loads dropped DLL
Modifies file permissions
Reads user/profile data of web browsers
Creates new service(s)
Executes dropped EXE
Modifies Windows Firewall
Sets service image path in registry
Identifies VirtualBox via ACPI registry values (likely anti-VM)
SmokeLoader
Taurus Stealer
Tofsee
Malware Config
C2 Extraction:
http://xsss99.icu/upload/
http://bingooodsg.icu/upload/
http://junntd.xyz/upload/
http://ginessa11.xyz/upload/
http://overplayninsx.xyz/upload/
http://bananinze.com/upload/
http://daunimlas.com/upload/
Unpacked files
SH256 hash:
9182f5904e7eba21a624a9773b407b91b3ce62fe468eb2f08900097a2c11c736
MD5 hash:
83214661ec613049f6ac027885953f70
SHA1 hash:
48771dca71cded7df146802801f4c09b8fd0fd3b
Link:
https://www.unpac.me/results/5f89c3de-bf21-4fd4-a2e3-41552b0867a5/
SH256 hash:
fb2e2174a3ec526861932043c1aa5b5e62e3abed0bb73e88e495eab66635e758
MD5 hash:
e0059c4ad73116bf0ea29d575ea2c175
SHA1 hash:
a1316534bb8a3b52ec4f14d8c3172e49f6c5760f
Link:
https://www.unpac.me/results/5f89c3de-bf21-4fd4-a2e3-41552b0867a5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fb2e2174a3ec526861932043c1aa5b5e62e3abed0bb73e88e495eab66635e758

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Smoke Loader

Executable exe fb2e2174a3ec526861932043c1aa5b5e62e3abed0bb73e88e495eab66635e758

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1095253/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/127471/

Comments