Extracted

• • Target

    359fedb7b9b070ba878501c49ad613ba_JaffaCakes118

  • Size

    370KB

  • MD5

    359fedb7b9b070ba878501c49ad613ba

  • SHA1

    960c747a52cfb82edbcba9f2e8ef6d4b65e85995

  • SHA256

    bd757e2555712d97f1e557ceac39378bb7fa0e2f01492ebde67b07c56ea58925

  • SHA512

    85c23333f93d784c81880f60609ce77eac48efa20c121025ddd13bce0decc5169322b81b1c2ed3137fd54927afba9a61c851760c39b66e74c0c6eaa59b8b581f

  • SSDEEP

    6144:V6Uqd2GhNOfMS6VsA83QLw/594YjZULEFXxzFhvl4lZcD:MUi2iN+MJVs4UpjZEEbFh9B

  Score

  10^/10

  snakekeyloggerevasionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2