Extracted

• • Target

    c5af54622602c908d5af6c3d8d7bdb09_JaffaCakes118

  • Size

    846KB

  • MD5

    c5af54622602c908d5af6c3d8d7bdb09

  • SHA1

    67fbbcaef7c841afc2af6cda2740b3f934cd9c15

  • SHA256

    bbeac700ec88ce4b23f0bb5c996effc1586ef0e7802bc18695ecd3845a2a0022

  • SHA512

    b1194332113c466ddfb55bf4f6f0dd6a04bc3ceeac9654a913d0ac38689a93fa08888b950af0a701cfb7490ca1c322fbebe77f281be27c2a2a05e78dfa3d8961

  • SSDEEP

    24576:5vVPp9AR95STVO0NF64RWPOyvzQ6bnVOGeuo8:5vVPpKRSs0KBOybx

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2