Extracted

• • Target

    b260e86e981f82edde6d7677c9a0bc53_JaffaCakes118

  • Size

    672KB

  • MD5

    b260e86e981f82edde6d7677c9a0bc53

  • SHA1

    e7dfbb61312e3035c8bf9605b8d0216a13a45f10

  • SHA256

    143be0a978733c4e1f40d9d21da589d9752ff96573ca35d6748a8d7c7abec9fb

  • SHA512

    011a31c08c546093a0e3112e63924ae4c31a6a4680dc3272a5485f69197ec97a075170381499fd43e0681d94435b94cc6d46d4f299c3db8670450a2d95d03dee

  • SSDEEP

    6144:AOaY7WeQ+3HwOExxB3+AkmZlIKl1U7ZoQQ8SF9xwcRcSVztoOZA+YbtEdqzM9fqr:bIoGPl3XQ1SFeSVztokAEt9fhM

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2