Extracted

• • Target

    f0fca1b55d2c4ff10dbfdcef2adf9ce3_JaffaCakes118

  • Size

    3.1MB

  • MD5

    f0fca1b55d2c4ff10dbfdcef2adf9ce3

  • SHA1

    895f50ff44202f5c8ad172fcb4ac7d3b2ca61048

  • SHA256

    33766f55f3cfa479be51a17369a86587f60b548ee6853eb0394aa8dba0806e79

  • SHA512

    e62368a43052ea1c966d9717c11b3e57aa2b0f7fcb3454ddfdad8a052263d840319d512bd4175696dffded01204e4fdd7a228cce5ca586c096640a0cf0bb7cba

  • SSDEEP

    3072:BFAhvOwXbK7DmqvI48q+xvp4XbzhiGecFWARcPvSvSvaHW9zSvSv5/GICO5LUFFq:6

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Uses the VBS compiler for execution

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2