Extracted

• • Target

    359fe50da784837a211d102faed66a71_JaffaCakes118

  • Size

    717KB

  • MD5

    359fe50da784837a211d102faed66a71

  • SHA1

    4624a4762f7d5fe677bd0d36d07604fb46ccacf2

  • SHA256

    b9af2b45175e80a5f2d5b2be3cfd068e180f710c893ae615d6f991adf3649131

  • SHA512

    92d761dbb2c5e3da0494bf425533c28259f3d930a8c7664e3f387e3349274987e658b111a21df15f0b112ab73866fb64a91eb350fc078c5be75f4fa902600982

  • SSDEEP

    12288:1owm6zx69p7RcuYqlqhZ0u1ZWaO0Fn/oWu2g9DGGnYfY1D2K36hKrSndgbHalXqm:1owmlYqshZzM0Fn/o/PQod1qK36hKrS3

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2