Extracted

• • Target

    c748fef02603811b9e3b1b280d9a6519_JaffaCakes118

  • Size

    806KB

  • MD5

    c748fef02603811b9e3b1b280d9a6519

  • SHA1

    dc970ef5af401b895b3d3e5fd5b040dc227cebda

  • SHA256

    f8f07bd1186be13a4fd113537b6d361b5279b1d25f7adbf874e5c6ced9c3f91a

  • SHA512

    88081a59c0181056929203020930dd0682c367cadf45f2a0077ba40a8db3d5dcd170825d19d72c045298499198042272b3d367029d2071a2c1809d84500ace09

  • SSDEEP

    12288:H1KFn3qGaNHEyC9/oR9gy5FHK7znXj1jvXpMjku9uiahDlXu27MbV+Hllo:H1KVPp9AR95yzXj1zXskdisM/kllo

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2