Extracted

• • Target

    5a150f8752d5553cab3b640f33d0786e_JaffaCakes118

  • Size

    717KB

  • MD5

    5a150f8752d5553cab3b640f33d0786e

  • SHA1

    72b30709a7d5a824ce8f00397c1602ddda1cb05b

  • SHA256

    c54c2f66a5691aa9b18c133ef391d36ae13cd4686ef4448ccd4ad5cb20d6e1d8

  • SHA512

    ab2827d7fd0da87e0cde3ca88a150d565027730ad9770b8df015d32805f02b9831a7bdf1c6f890f792b7c402a34fd47031619117fbb8a27f0b0a79fbcafda7a8

  • SSDEEP

    12288:kv9Lf/qlL2iNeHK7zgn1nyiV2BPWtgJ21xaCIRkdOwFllDOKtvalFFTof:kQR1bUn1tV2B+ACIKdOwFllD4po

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2