Extracted

• • Target

    ec2e55e29b1b4aaf588c4fa6f6b62300_JaffaCakes118

  • Size

    10.0MB

  • MD5

    ec2e55e29b1b4aaf588c4fa6f6b62300

  • SHA1

    a31c483891d4fe5903ff0c0070f3850db437007b

  • SHA256

    30b1a884738e4fc2f2c2e0037be1be4783042022742acd496995cde5414250b6

  • SHA512

    ead42739060cbdc67fe1cff45c6bfc26d5c1d835f7bbd7a66300b4c9c987d6554e89a3c43d166cdc1e1358901e8101a51b08847f67aef2b6f72ef0825d7815b4

  • SSDEEP

    12288:astYdODLqJmNuoLkJAN6e718zT+p6fhX/v3F41k/052cBYF3swef:astY4PTv/06pWZn3wkM5vBk3G

  Score

  10^/10

  snakekeyloggerkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2