Extracted

• • Target

    804c2fb52752597cd0fdae9838df7d08_JaffaCakes118

  • Size

    893KB

  • MD5

    804c2fb52752597cd0fdae9838df7d08

  • SHA1

    a5ebf568c0e7f81a5f6854ed9a690a948f804dd2

  • SHA256

    0a101b8b739c481e387e2daf5d85aaa93cf0188ff798233817e2e349b7ac1fe9

  • SHA512

    dfea22fcd622b5dd02f095e9148c68c9d135c654b1974a163253f783199895f58684b55b7994ba4e227c0f25463a1795460f97a94d3c92e421d5afe7819e6f27

  • SSDEEP

    12288:sJtPdGVDaHK7zTe++KINAeU+dy7fOhL8sCTqegHCcxvKIHWBSGm:sJYO+VluZL8sCTyHlZdH2S

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2