Extracted

• • Target

    26108db5b69562376697d90215395c87_JaffaCakes118

  • Size

    2.2MB

  • MD5

    26108db5b69562376697d90215395c87

  • SHA1

    ebd57ecda0c2a6cca843ead90d9c845376dfe47a

  • SHA256

    406776bc31b30cd94d3e6e50ea5adfac4817b2787c49f02e9ac096ea128f4843

  • SHA512

    d29a60d5dbe056f65a0655752e0a95a19718d021db8ad2d117e543bafeb46730f238facb3e3b1b7175a6de7e0915150b32686a4310d3b7dadf291ed1f52a249e

  • SSDEEP

    12288:mcf8x8hkm0WhdWCOt58IWDNuuc2eXNPnrEdrE:duj8IWDNuucxXN/odo

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2