win.smokeloader (Back to overview)

SmokeLoader

aka: Dofoil
URLhaus            

The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.

References
https://blog.badtrace.com/post/anti-hooking-checks-of-smokeloader-2018/
https://blog.malwarebytes.com/cybercrime/2018/01/fake-spectre-and-meltdown-patch-pushes-smoke-loader/
https://blog.malwarebytes.com/threat-analysis/2016/08/smoke-loader-downloader-with-a-smokescreen-still-alive/
https://blog.malwarebytes.com/threat-analysis/2016/10/new-looking-sundown-ek-drops-smoke-loader-kronos-banker/
https://blog.talosintelligence.com/2018/07/smoking-guns-smoke-loader-learned-new.html
https://cloudblogs.microsoft.com/microsoftsecure/2018/04/04/hunting-down-dofoil-with-windows-defender-atp/
https://eternal-todo.com/blog/smokeloader-analysis-yulia-photo
https://info.phishlabs.com/blog/smoke-loader-adds-additional-obfuscation-methods-to-mitigate-analysis
https://int0xcc.svbtle.com/a-taste-of-our-own-medicine-how-smokeloader-is-deceiving-dynamic-configuration-extraction-by-using-binary-code-as-bait
https://malwarebreakdown.com/2017/04/03/shadow-server-domains-leads-to-rig-exploit-kit-dropping-smoke-loader-which-downloads-neutrino-bot-aka-kasidet/
https://research.checkpoint.com/2019-resurgence-of-smokeloader/
https://www.cert.pl/en/news/single/dissecting-smoke-loader/
https://www.proofpoint.com/us/threat-insight/post/2019-return-retefe
https://www.spamhaus.org/news/article/774/smoke-loader-improves-encryption-after-microsoft-spoils-its-campaign
Yara Rules
[TLP:WHITE] win_smokeloader_auto (20190620 | autogenerated rule brought to you by yara-signator)
rule win_smokeloader_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2019-07-05"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator 0.2a"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader"
        malpedia_version = "20190620"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using yara-signator.
     * The code and documentation / approach is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */

    strings:
        $sequence_0 = { ff15???????? 8d45f0 50 8d45e8 50 8d45e0 50 }
            // n = 7, score = 1300
            //   ff15????????         |                     
            //   8d45f0               | lea                 eax, [ebp - 0x10]
            //   50                   | push                eax
            //   8d45e8               | lea                 eax, [ebp - 0x18]
            //   50                   | push                eax
            //   8d45e0               | lea                 eax, [ebp - 0x20]
            //   50                   | push                eax

        $sequence_1 = { ff15???????? 8d45f0 50 8d45e8 50 8d45e0 50 }
            // n = 7, score = 1300
            //   ff15????????         |                     
            //   8d45f0               | lea                 eax, [ebp - 0x10]
            //   50                   | push                eax
            //   8d45e8               | lea                 eax, [ebp - 0x18]
            //   50                   | push                eax
            //   8d45e0               | lea                 eax, [ebp - 0x20]
            //   50                   | push                eax

        $sequence_2 = { ff15???????? 8d45f0 50 8d45e8 50 8d45e0 50 }
            // n = 7, score = 1300
            //   ff15????????         |                     
            //   8d45f0               | lea                 eax, [ebp - 0x10]
            //   50                   | push                eax
            //   8d45e8               | lea                 eax, [ebp - 0x18]
            //   50                   | push                eax
            //   8d45e0               | lea                 eax, [ebp - 0x20]
            //   50                   | push                eax

        $sequence_3 = { ff15???????? 8d45f0 50 8d45e8 50 8d45e0 }
            // n = 6, score = 1300
            //   ff15????????         |                     
            //   8d45f0               | lea                 eax, [ebp - 0x10]
            //   50                   | push                eax
            //   8d45e8               | lea                 eax, [ebp - 0x18]
            //   50                   | push                eax
            //   8d45e0               | lea                 eax, [ebp - 0x20]

        $sequence_4 = { ff15???????? 8d45f0 50 8d45e8 50 8d45e0 }
            // n = 6, score = 1300
            //   ff15????????         |                     
            //   8d45f0               | lea                 eax, [ebp - 0x10]
            //   50                   | push                eax
            //   8d45e8               | lea                 eax, [ebp - 0x18]
            //   50                   | push                eax
            //   8d45e0               | lea                 eax, [ebp - 0x20]

        $sequence_5 = { ff15???????? 8d45f0 50 8d45e8 50 8d45e0 }
            // n = 6, score = 1300
            //   ff15????????         |                     
            //   8d45f0               | lea                 eax, [ebp - 0x10]
            //   50                   | push                eax
            //   8d45e8               | lea                 eax, [ebp - 0x18]
            //   50                   | push                eax
            //   8d45e0               | lea                 eax, [ebp - 0x20]

        $sequence_6 = { 3d00100000 0f8????????? 3907 0f8????????? }
            // n = 4, score = 1100
            //   3d00100000           | cmp                 eax, 0x1000
            //   0f8?????????         |                     
            //   3907                 | cmp                 dword ptr [edi], eax
            //   0f8?????????         |                     

        $sequence_7 = { 8bf0 8d45dc 50 6a00 53 ff15???????? 8d45f0 }
            // n = 7, score = 1100
            //   8bf0                 | mov                 esi, eax
            //   8d45dc               | lea                 eax, [ebp - 0x24]
            //   50                   | push                eax
            //   6a00                 | push                0
            //   53                   | push                ebx
            //   ff15????????         |                     
            //   8d45f0               | lea                 eax, [ebp - 0x10]

        $sequence_8 = { 6a00 53 ff15???????? 8d45f0 }
            // n = 4, score = 1100
            //   6a00                 | push                0
            //   53                   | push                ebx
            //   ff15????????         |                     
            //   8d45f0               | lea                 eax, [ebp - 0x10]

        $sequence_9 = { 57 ff15???????? 6a00 6800000002 6a03 }
            // n = 5, score = 1100
            //   57                   | push                edi
            //   ff15????????         |                     
            //   6a00                 | push                0
            //   6800000002           | push                0x2000000
            //   6a03                 | push                3

        $sequence_10 = { 3d00100000 0f8????????? 3907 0f8????????? }
            // n = 4, score = 1100
            //   3d00100000           | cmp                 eax, 0x1000
            //   0f8?????????         |                     
            //   3907                 | cmp                 dword ptr [edi], eax
            //   0f8?????????         |                     

        $sequence_11 = { ff15???????? 8bf0 8d45dc 50 6a00 53 }
            // n = 6, score = 1100
            //   ff15????????         |                     
            //   8bf0                 | mov                 esi, eax
            //   8d45dc               | lea                 eax, [ebp - 0x24]
            //   50                   | push                eax
            //   6a00                 | push                0
            //   53                   | push                ebx

        $sequence_12 = { 3d00100000 0f8????????? 3907 0f8????????? }
            // n = 4, score = 1100
            //   3d00100000           | cmp                 eax, 0x1000
            //   0f8?????????         |                     
            //   3907                 | cmp                 dword ptr [edi], eax
            //   0f8?????????         |                     

        $sequence_13 = { e8???????? 6870170000 ff15???????? eb?? }
            // n = 4, score = 1100
            //   e8????????           |                     
            //   6870170000           | push                0x1770
            //   ff15????????         |                     
            //   eb??                 |                     

        $sequence_14 = { 3c3a 74?? 3c2f 75?? }
            // n = 4, score = 900
            //   3c3a                 | cmp                 al, 0x3a
            //   74??                 |                     
            //   3c2f                 | cmp                 al, 0x2f
            //   75??                 |                     

        $sequence_15 = { ff15???????? bf90010000 8bcf e8???????? }
            // n = 4, score = 900
            //   ff15????????         |                     
            //   bf90010000           | mov                 edi, 0x190
            //   8bcf                 | mov                 ecx, edi
            //   e8????????           |                     

        $sequence_16 = { ff15???????? bf90010000 8bcf e8???????? }
            // n = 4, score = 900
            //   ff15????????         |                     
            //   bf90010000           | mov                 edi, 0x190
            //   8bcf                 | mov                 ecx, edi
            //   e8????????           |                     

        $sequence_17 = { 33c0 e9???????? e8???????? b904010000 }
            // n = 4, score = 800
            //   33c0                 | xor                 eax, eax
            //   e9????????           |                     
            //   e8????????           |                     
            //   b904010000           | mov                 ecx, 0x104

        $sequence_18 = { 75?? 33c0 e9???????? e8???????? b904010000 }
            // n = 5, score = 800
            //   75??                 |                     
            //   33c0                 | xor                 eax, eax
            //   e9????????           |                     
            //   e8????????           |                     
            //   b904010000           | mov                 ecx, 0x104

        $sequence_19 = { 832000 ff15???????? 85c0 0f8????????? }
            // n = 4, score = 800
            //   832000               | and                 dword ptr [eax], 0
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax
            //   0f8?????????         |                     

        $sequence_20 = { 89d0 c1e205 01c2 31c0 }
            // n = 4, score = 500
            //   89d0                 | mov                 eax, edx
            //   c1e205               | shl                 edx, 5
            //   01c2                 | add                 edx, eax
            //   31c0                 | xor                 eax, eax

        $sequence_21 = { 30d0 aa e2?? 75?? }
            // n = 4, score = 500
            //   30d0                 | xor                 al, dl
            //   aa                   | stosb               byte ptr es:[edi], al
            //   e2??                 |                     
            //   75??                 |                     

        $sequence_22 = { c1e205 01c2 31c0 ac }
            // n = 4, score = 500
            //   c1e205               | shl                 edx, 5
            //   01c2                 | add                 edx, eax
            //   31c0                 | xor                 eax, eax
            //   ac                   | lodsb               al, byte ptr [esi]

        $sequence_23 = { 01c2 31c0 ac 01c2 85c0 75?? }
            // n = 6, score = 500
            //   01c2                 | add                 edx, eax
            //   31c0                 | xor                 eax, eax
            //   ac                   | lodsb               al, byte ptr [esi]
            //   01c2                 | add                 edx, eax
            //   85c0                 | test                eax, eax
            //   75??                 |                     

        $sequence_24 = { c1e205 01c2 31c0 ac 01c2 85c0 75?? }
            // n = 7, score = 500
            //   c1e205               | shl                 edx, 5
            //   01c2                 | add                 edx, eax
            //   31c0                 | xor                 eax, eax
            //   ac                   | lodsb               al, byte ptr [esi]
            //   01c2                 | add                 edx, eax
            //   85c0                 | test                eax, eax
            //   75??                 |                     

        $sequence_25 = { 89d0 c1e205 01c2 31c0 }
            // n = 4, score = 500
            //   89d0                 | mov                 eax, edx
            //   c1e205               | shl                 edx, 5
            //   01c2                 | add                 edx, eax
            //   31c0                 | xor                 eax, eax

        $sequence_26 = { 30d0 aa e2?? 75?? }
            // n = 4, score = 500
            //   30d0                 | xor                 al, dl
            //   aa                   | stosb               byte ptr es:[edi], al
            //   e2??                 |                     
            //   75??                 |                     

        $sequence_27 = { 01c2 31c0 ac 01c2 85c0 }
            // n = 5, score = 500
            //   01c2                 | add                 edx, eax
            //   31c0                 | xor                 eax, eax
            //   ac                   | lodsb               al, byte ptr [esi]
            //   01c2                 | add                 edx, eax
            //   85c0                 | test                eax, eax

        $sequence_28 = { c70200000000 6800800000 52 51 6aff }
            // n = 5, score = 400
            //   c70200000000         | mov                 dword ptr [edx], 0
            //   6800800000           | push                0x8000
            //   52                   | push                edx
            //   51                   | push                ecx
            //   6aff                 | push                -1

        $sequence_29 = { 56 53 e8???????? 85c0 74?? 8985ecfdffff }
            // n = 6, score = 400
            //   56                   | push                esi
            //   53                   | push                ebx
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   74??                 |                     
            //   8985ecfdffff         | mov                 dword ptr [ebp - 0x214], eax

        $sequence_30 = { 8d95f0fdffff c70200000000 6800800000 52 51 }
            // n = 5, score = 400
            //   8d95f0fdffff         | lea                 edx, [ebp - 0x210]
            //   c70200000000         | mov                 dword ptr [edx], 0
            //   6800800000           | push                0x8000
            //   52                   | push                edx
            //   51                   | push                ecx

        $sequence_31 = { 8d8decfdffff 8d95f0fdffff c70200000000 6800800000 52 51 6aff }
            // n = 7, score = 400
            //   8d8decfdffff         | lea                 ecx, [ebp - 0x214]
            //   8d95f0fdffff         | lea                 edx, [ebp - 0x210]
            //   c70200000000         | mov                 dword ptr [edx], 0
            //   6800800000           | push                0x8000
            //   52                   | push                edx
            //   51                   | push                ecx
            //   6aff                 | push                -1

        $sequence_32 = { 57 56 53 e8???????? 85c0 74?? 8985ecfdffff }
            // n = 7, score = 400
            //   57                   | push                edi
            //   56                   | push                esi
            //   53                   | push                ebx
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   74??                 |                     
            //   8985ecfdffff         | mov                 dword ptr [ebp - 0x214], eax

        $sequence_33 = { 53 e8???????? 85c0 74?? 8985ecfdffff ffb5f0fdffff }
            // n = 6, score = 400
            //   53                   | push                ebx
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   74??                 |                     
            //   8985ecfdffff         | mov                 dword ptr [ebp - 0x214], eax
            //   ffb5f0fdffff         | push                dword ptr [ebp - 0x210]

        $sequence_34 = { e8???????? 85c0 74?? 8985ecfdffff }
            // n = 4, score = 400
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   74??                 |                     
            //   8985ecfdffff         | mov                 dword ptr [ebp - 0x214], eax

        $sequence_35 = { 8b7c2878 01ef 8b7720 01ee 56 }
            // n = 5, score = 300
            //   8b7c2878             | mov                 edi, dword ptr [eax + ebp + 0x78]
            //   01ef                 | add                 edi, ebp
            //   8b7720               | mov                 esi, dword ptr [edi + 0x20]
            //   01ee                 | add                 esi, ebp
            //   56                   | push                esi

        $sequence_36 = { 01ee 56 ad 01e8 }
            // n = 4, score = 300
            //   01ee                 | add                 esi, ebp
            //   56                   | push                esi
            //   ad                   | lodsd               eax, dword ptr [esi]
            //   01e8                 | add                 eax, ebp

        $sequence_37 = { 8b36 384f18 75?? 89ab00050000 8db304050000 }
            // n = 5, score = 300
            //   8b36                 | mov                 esi, dword ptr [esi]
            //   384f18               | cmp                 byte ptr [edi + 0x18], cl
            //   75??                 |                     
            //   89ab00050000         | mov                 dword ptr [ebx + 0x500], ebp
            //   8db304050000         | lea                 esi, [ebx + 0x504]

        $sequence_38 = { 75?? c3 56 89c2 8b453c 8b7c2878 }
            // n = 6, score = 300
            //   75??                 |                     
            //   c3                   | ret                 
            //   56                   | push                esi
            //   89c2                 | mov                 edx, eax
            //   8b453c               | mov                 eax, dword ptr [ebp + 0x3c]
            //   8b7c2878             | mov                 edi, dword ptr [eax + ebp + 0x78]

        $sequence_39 = { c3 eb?? e8???????? 8946fc ad 85c0 75?? }
            // n = 7, score = 300
            //   c3                   | ret                 
            //   eb??                 |                     
            //   e8????????           |                     
            //   8946fc               | mov                 dword ptr [esi - 4], eax
            //   ad                   | lodsd               eax, dword ptr [esi]
            //   85c0                 | test                eax, eax
            //   75??                 |                     

        $sequence_40 = { ad 85c0 75?? c3 56 89c2 }
            // n = 6, score = 300
            //   ad                   | lodsd               eax, dword ptr [esi]
            //   85c0                 | test                eax, eax
            //   75??                 |                     
            //   c3                   | ret                 
            //   56                   | push                esi
            //   89c2                 | mov                 edx, eax

        $sequence_41 = { 8b760c 8b761c 8b6e08 8b7e20 8b36 }
            // n = 5, score = 300
            //   8b760c               | mov                 esi, dword ptr [esi + 0xc]
            //   8b761c               | mov                 esi, dword ptr [esi + 0x1c]
            //   8b6e08               | mov                 ebp, dword ptr [esi + 8]
            //   8b7e20               | mov                 edi, dword ptr [esi + 0x20]
            //   8b36                 | mov                 esi, dword ptr [esi]

        $sequence_42 = { 31d1 75?? 58 29c6 d1ee 037724 0fb7442efe }
            // n = 7, score = 300
            //   31d1                 | xor                 ecx, edx
            //   75??                 |                     
            //   58                   | pop                 eax
            //   29c6                 | sub                 esi, eax
            //   d1ee                 | shr                 esi, 1
            //   037724               | add                 esi, dword ptr [edi + 0x24]
            //   0fb7442efe           | movzx               eax, word ptr [esi + ebp - 2]

        $sequence_43 = { c645c500 8d45c0 50 e8???????? }
            // n = 4, score = 200
            //   c645c500             | mov                 byte ptr [ebp - 0x3b], 0
            //   8d45c0               | lea                 eax, [ebp - 0x40]
            //   50                   | push                eax
            //   e8????????           |                     

        $sequence_44 = { 8b55f8 0fb70a c1e103 33d2 f7f1 8945fc 8b45fc }
            // n = 7, score = 200
            //   8b55f8               | mov                 edx, dword ptr [ebp - 8]
            //   0fb70a               | movzx               ecx, word ptr [edx]
            //   c1e103               | shl                 ecx, 3
            //   33d2                 | xor                 edx, edx
            //   f7f1                 | div                 ecx
            //   8945fc               | mov                 dword ptr [ebp - 4], eax
            //   8b45fc               | mov                 eax, dword ptr [ebp - 4]

        $sequence_45 = { 8b5584 895154 68f41593b0 8b45e4 50 }
            // n = 5, score = 200
            //   8b5584               | mov                 edx, dword ptr [ebp - 0x7c]
            //   895154               | mov                 dword ptr [ecx + 0x54], edx
            //   68f41593b0           | push                0xb09315f4
            //   8b45e4               | mov                 eax, dword ptr [ebp - 0x1c]
            //   50                   | push                eax

        $sequence_46 = { 50 e8???????? 8945d4 8b4da0 8b55d4 895120 688dbdc13f }
            // n = 7, score = 200
            //   50                   | push                eax
            //   e8????????           |                     
            //   8945d4               | mov                 dword ptr [ebp - 0x2c], eax
            //   8b4da0               | mov                 ecx, dword ptr [ebp - 0x60]
            //   8b55d4               | mov                 edx, dword ptr [ebp - 0x2c]
            //   895120               | mov                 dword ptr [ecx + 0x20], edx
            //   688dbdc13f           | push                0x3fc1bd8d

        $sequence_47 = { 895140 6820fa1477 8b8578ffffff 50 }
            // n = 4, score = 200
            //   895140               | mov                 dword ptr [ecx + 0x40], edx
            //   6820fa1477           | push                0x7714fa20
            //   8b8578ffffff         | mov                 eax, dword ptr [ebp - 0x88]
            //   50                   | push                eax

        $sequence_48 = { 75?? 8b4d84 8b55d8 895118 }
            // n = 4, score = 200
            //   75??                 |                     
            //   8b4d84               | mov                 ecx, dword ptr [ebp - 0x7c]
            //   8b55d8               | mov                 edx, dword ptr [ebp - 0x28]
            //   895118               | mov                 dword ptr [ecx + 0x18], edx

        $sequence_49 = { 83e806 8945f8 8b4df8 8b4102 2d10bf3400 8b55f8 0fb70a }
            // n = 7, score = 200
            //   83e806               | sub                 eax, 6
            //   8945f8               | mov                 dword ptr [ebp - 8], eax
            //   8b4df8               | mov                 ecx, dword ptr [ebp - 8]
            //   8b4102               | mov                 eax, dword ptr [ecx + 2]
            //   2d10bf3400           | sub                 eax, 0x34bf10
            //   8b55f8               | mov                 edx, dword ptr [ebp - 8]
            //   0fb70a               | movzx               ecx, word ptr [edx]

        $sequence_50 = { 8b4da0 8b55cc 895144 68d770a437 8b8578ffffff 50 e8???????? }
            // n = 7, score = 200
            //   8b4da0               | mov                 ecx, dword ptr [ebp - 0x60]
            //   8b55cc               | mov                 edx, dword ptr [ebp - 0x34]
            //   895144               | mov                 dword ptr [ecx + 0x44], edx
            //   68d770a437           | push                0x37a470d7
            //   8b8578ffffff         | mov                 eax, dword ptr [ebp - 0x88]
            //   50                   | push                eax
            //   e8????????           |                     

    condition:
        7 of them
}
Download all Yara Rules