Extracted

• • Target

    bb907cff6ef7b1193fd4db7204a0014e_JaffaCakes118

  • Size

    839KB

  • MD5

    bb907cff6ef7b1193fd4db7204a0014e

  • SHA1

    2b04f9409d6bfb8b5eb1b55f024d72b81cc46008

  • SHA256

    40279a0eec5f0080c04b299b86bc5aab31d1900b5d63787d713e48fa96d3b8e9

  • SHA512

    a62c3ca0198d75be8c85d8b1ffc5a6e9e74a9b1dafb623891a7e42da4aa22ae47034a126966cd244bfd3ccc172312cc25cf97961c75bcd532d2edcb3afd1cf24

  • SSDEEP

    12288:Yih79fOurYm+ijO8kLhlLFezZQrSfvgImxtHuhHK7zszKbolL7F:Ym7922mR59lLFezqelmxVeKboH

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2