Extracted

• • Target

    091d4aedc9c644e2da021f9db1a0d761_JaffaCakes118

  • Size

    696KB

  • MD5

    091d4aedc9c644e2da021f9db1a0d761

  • SHA1

    417c5d4f98379722badd4cbb5c73e7973550e613

  • SHA256

    4fb034c90b25107c2ec0f0939f442aea880023c212c39cfed3b995bfeb6c7248

  • SHA512

    2cf80f127c689b687e370fdda284de22ef53dc55f2c48b5baa059652d5ee0db7529c872c10e1e6bba9df059f7be8d84cdd4c205cca0bfdb037eade9db0c090b2

  • SSDEEP

    12288:X4qk3/t2NjFCRoYCHgGAfasxO31QJuTizjAwWaT:X4qUMNj8JCAGQax1QJ/vWI

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2