Extracted

• • Target

    f281e6f97227cfdcb2edca1037fb0efb_JaffaCakes118

  • Size

    827KB

  • MD5

    f281e6f97227cfdcb2edca1037fb0efb

  • SHA1

    745c3bd6b590aee05eb9af4bb6241df002796873

  • SHA256

    67108fc6d911e90188c65b91728152289ba95b48ab037fecf68822c818c4c812

  • SHA512

    e0e21957ffaf42e1f7d6192a77c1c60313b293860bfd8f82f54568d5249782e891ac8b2e3f4133f2e26d3c6433594b13086c68127f16d769fbc61245d209c2d8

  • SSDEEP

    12288:Sl4XsYCvxGbhXycaJ1JY5U2OgwXtr2R72pn+ixmeE2wT:79CpGdy9J1m5Vo2R7Cn+i8/1

  Score

  10^/10

  snakekeyloggercollectioncredential_accessdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Credentials from Password Stores: Credentials from Web Browsers

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2