Extracted

• • Target

    d7bfea917fbf27fb1f0d42cfbebdf9b5_JaffaCakes118

  • Size

    945KB

  • MD5

    d7bfea917fbf27fb1f0d42cfbebdf9b5

  • SHA1

    5092ec51af1ddba591705e949c715b45f99df623

  • SHA256

    ee1712138af6c15a73dd3cf46f2b3b23923270a041930a89e231dfce8364cfcd

  • SHA512

    ab82ff4b456280cf59d247fa2b3904f797fff7761f39c0ebba96561a5dfc636c3b41175cb30ccdea6ca3b03ea40ef824dd4ba6fd3a12688a3d45c96121e5e50f

  • SSDEEP

    12288:PKpVLT9kUY/OpLtE0M3LiWy+7NFiXkeG3nzrhmkZNtfssy8SBl68Qp:P2VX9kU1pLtET7NFCkzz8kZHF

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2