Extracted

• • Target

    c0a639c806d21523000d0b8a3114108e_JaffaCakes118

  • Size

    636KB

  • MD5

    c0a639c806d21523000d0b8a3114108e

  • SHA1

    bdb9e535b4948dc53a4acd25f305f6c4e3d2583c

  • SHA256

    5f5cceffd607b1938c60c5052d3d2d32e03c7e2eed2bbc3c05650aed338cfdc3

  • SHA512

    51d65c24dbfc56457750489f5971b800992f4ae273a7f7871059a909c3709a4d132b594fb0264f290f1994193f8e092338e25ca796f3ce65d98603d57722dfff

  • SSDEEP

    12288:Hlb29S2iNeHK7zBjTSN1a5ld2b7UECHBlL0bRRLPcwZaaoL1fx:HlSw1bJT1jd0CHBl0DLUYDIx

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2