Extracted

• • Target

    f0f1583895386c2bf77a4fdee48fc4cf_JaffaCakes118

  • Size

    1.1MB

  • MD5

    f0f1583895386c2bf77a4fdee48fc4cf

  • SHA1

    df02abba060791e255e9129a7819d6a3f332bd6f

  • SHA256

    9ee1bd8d321c0f2b59c8d9005f174cfdee3476d00f5fa9005655d0ca6bb22afd

  • SHA512

    26534e4d176e4b107b53df817e763b53be2c74d73ab67572a72ae9f6c6421cec601b371aad5fa238d3837a2cea3d5b85b5529c0521dd559ff651a8b6897c5143

  • SSDEEP

    12288:nX2map3Mj6jRPLjRPqjBjjyjBjBjBjBjLjbJJYpekFFFEOmW2UyJ21aN0F3h2A6W:nmvzkFFFHRjx/l5D

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2