Extracted

• • Target

    87dbb557eb789fdb91c6180f421a4595_JaffaCakes118

  • Size

    821KB

  • MD5

    87dbb557eb789fdb91c6180f421a4595

  • SHA1

    23ec3a5326f4b8066c03ccb1ab6ce4000870380a

  • SHA256

    dd540f0947ab9b8439475241615e16835a7970c27649710c5a4510bbf0d8096d

  • SHA512

    57d8f212696faae66faaa0e6ad9a10c3b897a6150f41c94fce84eb0dc81549d2a039510862f7fa9b352eb43d40bbf0bc551354e532ae81684eb0c8f0cfbd511b

  • SSDEEP

    12288:yvgHGNRRdKMIY3rNisYdEq101A37B7d/Gp2K/TNHK7zxzKbolL7F:IgHIRdjIY35isk/EA3l7de1/TgBKboH

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2