Extracted

• • Target
    d998151c5f135ab73d6336c1f1d2512d_JaffaCakes118
  • Size 157KB
  • SHA256 dca6e2b783dab78c14ddf9091de65952665a614ecdc8124d9ffe02cca3315dbb
  • MD5 d998151c5f135ab73d6336c1f1d2512d
  • SHA1 6509b6e31176137ff0f0a7b5cf37b73cb2b64c77
  • SHA512 1d04df68812994954ac6bb96c4f28e0070e4d8a532d9720ebbda7b96b9f263213d46143019a12964b0cce8dddc583f80d14455d684d33b7d0951c362b1f8fc0f
  • SSDEEP 3072:X1E/rS2paccKntcPeqgKJ+BC185Y/SpJMXt7fkDehq9Ema0trWa6awu:X1onigKGjpaXta9EWrWw1
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  smokeloaderbackdoordiscoverypersistencetrojan

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/InstallOptions.dll
  • Size 14KB
  • SHA256 fe19353288a08a5d2640a9c022424a1d20e4909a351f2114423e087313a40d7c
  • MD5 3e277798b9d8f48806fbb5ebfd4990db
  • SHA1 d1ab343c5792bc99599ec7acba506e8ba7e05969
  • SHA512 84c9d4e2e6872277bffb0e10b292c8c384d475ad163fd0a47ca924a3c79077dfde880f535a171660f73265792554129161d079a10057d44e28e2d57ebc477e92
  • SSDEEP 192:d4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjsK72dwF7dBOne:Wn3T5KdHCMRD/R1cOnrjs+BO
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/LangDLL.dll
  • Size 5KB
  • SHA256 70c842f318f691d92e5829616a283aa9bf9dc18cea6f39bad028e176056b591a
  • MD5 b26b412d9f1050ad53f663c972fdcd9f
  • SHA1 7bc4ed444f3f8fd14c2c36784d828175bace8c17
  • SHA512 ba350a10b41c0cfe34c502e3d0e68fbfe1489448c85a282e0a5e444fa58d0dd8be2e566e21f0734a0debfc454f08b84140964c09c4c952f6a442642c911d7b46
  • SSDEEP 48:im14sjq8W2MPUptuMMFvx/om/ycNSCwVGfOY0vB6/JvR0Jpof5d2D:F1EBl91Z7/ycNSCwV8TLZR0Wd2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral5behavioral6
• • Target
    $PLUGINSDIR/StartMenu.dll
  • Size 7KB
  • SHA256 1cc68f4aef76d70d7326853f0e604ff3ac926c1dfe7aee7ad69a3259280a4e66
  • MD5 12281b59f907027f4d374b8423e2b0f9
  • SHA1 21216630633bb6cc4aa9b1c5873f345bbe06b74c
  • SHA512 7c8c7a5c7f8e6d7a0b5d54ad1bfc34831358487985bd64459cd22f45f82385f4740e7a62048b01759b79e3d0f05ccb8152d63c3d864f308146ce5c746a9296b6
  • SSDEEP 96:qgiqVPb3X8K8Kdr3gEq6nNdMk6Qiw290+q6LDtJ1tR3hhEl7y:qgiqVPgK8K9eIdE9B/tVhg7
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral7behavioral8
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
  • MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
  • SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
  • SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
  • SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral10behavioral9
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 f2c1409faf2952c1c91f4b5495158ef5c7d1a1db6eea4a18f163574bd52fcad0
  • MD5 b3070cf20db659fdfb3cb2ed38130e8d
  • SHA1 aa234b0620bebddde1414ff6b0840d883890b413
  • SHA512 4849a4cf24ea8a26cd04eb132d479cc093d4e204ed3866a77646d03778f4c128e20722a0c3cd62ea98a37deea4ce505fe632420158c71a10b0c8c5e32b38e3f1
  • SSDEEP 96:oEqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx40qndYHnxss:oEq+CP3uKrpyREs06YxEdGn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral11behavioral12
• • Target
    Uninstall.exe
  • Size 83KB
  • SHA256 78813c6eaad738de591046a6cc2e1d7d436d2e622057435f8e6e628bf1c7c202
  • MD5 5e82b3c5192a8a56bf96750c99679ea8
  • SHA1 a92dbc98cfa27ebb82f00f1b9fdffbd1f96c1ac0
  • SHA512 81eb5b2334660f64ddd2feb228d7cff658ce1d264d75c57655134ca46527d1ef8d1762497fccded9be97ec8762011cec65f4172873ad518f68ca3f055408e867
  • SSDEEP 1536:X1E/rzW2pakRmB7BW3nKsc9YRN6QcIGO8ig7+3rOpA2aCf:X1E/rS2paccKntc9qt8xormA2aU
  • MD5 SHA1 SHA512 SSDEEP

  Score

  7^/10

  discovery

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral13behavioral14
• • Target
    $PLUGINSDIR/LangDLL.dll
  • Size 5KB
  • SHA256 70c842f318f691d92e5829616a283aa9bf9dc18cea6f39bad028e176056b591a
  • MD5 b26b412d9f1050ad53f663c972fdcd9f
  • SHA1 7bc4ed444f3f8fd14c2c36784d828175bace8c17
  • SHA512 ba350a10b41c0cfe34c502e3d0e68fbfe1489448c85a282e0a5e444fa58d0dd8be2e566e21f0734a0debfc454f08b84140964c09c4c952f6a442642c911d7b46
  • SSDEEP 48:im14sjq8W2MPUptuMMFvx/om/ycNSCwVGfOY0vB6/JvR0Jpof5d2D:F1EBl91Z7/ycNSCwV8TLZR0Wd2
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral15behavioral16
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
  • MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
  • SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
  • SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
  • SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral17behavioral18
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 9KB
  • SHA256 f2c1409faf2952c1c91f4b5495158ef5c7d1a1db6eea4a18f163574bd52fcad0
  • MD5 b3070cf20db659fdfb3cb2ed38130e8d
  • SHA1 aa234b0620bebddde1414ff6b0840d883890b413
  • SHA512 4849a4cf24ea8a26cd04eb132d479cc093d4e204ed3866a77646d03778f4c128e20722a0c3cd62ea98a37deea4ce505fe632420158c71a10b0c8c5e32b38e3f1
  • SSDEEP 96:oEqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx40qndYHnxss:oEq+CP3uKrpyREs06YxEdGn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral19behavioral20