Extracted

• • Target

    2da974503435083870619f193cce232d_JaffaCakes118

  • Size

    535KB

  • MD5

    2da974503435083870619f193cce232d

  • SHA1

    6e9563867fb5103f166aa3ea894ee307e12f52bc

  • SHA256

    56fcefd42a16f026eae384a094bebb76bfeb13725314da2669d1c650332ed8f5

  • SHA512

    ecf3b6a1e3ec9925098fb985d7173e0e9bb68fbe4e99a1a9c4b29e848b408f913f58389c7cabf4a9c509cb75c8b6c05084a6715e662e77e3c6a3d49df7b691bf

  • SSDEEP

    12288:VzajzzNi+hBr7IUA16vSfEpYYsePTwnRiU3:VGNi+hBr8UA0mERWRi4

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2