Extracted

• • Target

    96abc0b6ea526451ba3a16aefd2828c6_JaffaCakes118

  • Size

    824KB

  • MD5

    96abc0b6ea526451ba3a16aefd2828c6

  • SHA1

    0f98c70acfbea63ea49d868e70d8d12ac9d03a9a

  • SHA256

    d6d15d2505b10290bc12a11dad3f85f8ba055aad43c9a573158fe7e5a32bc0d2

  • SHA512

    5712a06812e3a7b0b7913f1b92cb6cbccc5a5c0c1f579a6b887fe3f809b1392d75ecba413bbe17109145965a701e8214cae283fae28f668d1f56c4813837e120

  • SSDEEP

    24576:XslKPp9AR95SBCIut9KKWVwLCSp9BXSmaWUmWKx:NPpKRSBwtXqwWSpnSmaW

  Score

  10^/10

  snakekeyloggerdiscoveryevasionkeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2