Extracted

• • Target

    cdedf79a0a0bc6535e4c89124beee5c8_JaffaCakes118

  • Size

    846KB

  • MD5

    cdedf79a0a0bc6535e4c89124beee5c8

  • SHA1

    56e07564f400dbcb7766a505b170ccc0d7e98a23

  • SHA256

    be9229b4f9e3e523ff9562fcbb16a68b3707e6bd8192813352506471583eb6c0

  • SHA512

    5caaee5faf0ab875803cda11b6c6a36cd69ff8c569ac1a8499b4504db67daaf05f1881d2d643935f2b0510fc79a60169b148022b67e0b2bdf9615067ae33d05f

  • SSDEEP

    24576:i9wmFAvjfb7hxLjIL4ZXlWrR0RxQKboH:iwN7Hh9jIL4xlWi/v0H

  Score

  10^/10

  snakekeyloggerdiscoverykeyloggerstealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • Snakekeylogger family

    snakekeylogger

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2