Extracted

• • Target

    637c0a1232a65aba8a98acb8ec9787af_JaffaCakes118

  • Size

    2.2MB

  • MD5

    637c0a1232a65aba8a98acb8ec9787af

  • SHA1

    30f6d7422526ad16c3de841472eb2c8ebfe8cb3f

  • SHA256

    3559806841a45de7e6ed11acf6085ddbfb7ca67781e1db676b844b0e92ac30f9

  • SHA512

    0beeb98cbcacfb3a3e3321774321c18a8e5e569a4ae08889b01a214762ef0cf73c5b4d3f452aea45d74240612a791c936d7c8fe62476b333e0d3afd6cc65a938

  • SSDEEP

    12288:8F04OE0nuGRJuWtMSArkKali2eXNPnrEdrE:JxnuGFtM7rkKalixXN/odo

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2