Extracted

• • Target

    63c984080f6aaec5b7f2dca4af13c5f8_JaffaCakes118

  • Size

    2.2MB

  • MD5

    63c984080f6aaec5b7f2dca4af13c5f8

  • SHA1

    96b051a0df6708b89f9fa70fccb4729ed7e316dd

  • SHA256

    1216db955da408a0070ebd68abffd6978e62363fe917b55688b9df9f253d58cb

  • SHA512

    6318ee0788752b03bd321d4c771deaa0fc7fadb28db4a8b76db418a98531eaed31c099fd7d45afdf32dce60249a6f899ae956cb37ad891153bd4f2537fef3133

  • SSDEEP

    12288:ZT2ZSqvxWylRjX7OG0Pf6YnzW2eXNPnrEdrE:ZQ7jLOG0PfbzWxXN/odo

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2