Extracted

• • Target

    b090b4144e4293f45f16d885780066d1_JaffaCakes118

  • Size

    792KB

  • MD5

    b090b4144e4293f45f16d885780066d1

  • SHA1

    3bf83d8909138d9f50359ffed749dfa30a235916

  • SHA256

    41b0cd91e2297f1884e43e57dc85608ccc5826769f540fda01c817a05e8474b1

  • SHA512

    19cf80685424140b78ea7090b3aa151da47894c4f659ff4a2d1a73a6bdc5c965e1255b7c67962b27a486194715b2ae52fd6610d94f4224932391070b2579427e

  • SSDEEP

    6144:Uf0T+UGrOaq3hB9qtvF7iNnEzvoDWIKa93MRjcogdSv0A/Pj1nqrvdUDY3:2IOOBqXanEzvoDW098NNhJnWv+Y3

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2